Ensure Doc DB is encrypted by KMS using a customer managed Key (CMK)

Error: AWS Doc DB not encrypted using Customer Managed Key
Bridgecrew Policy ID: BC_AWS_GENERAL_102
Checkov Check ID: CKV_AWS_182
Severity: LOW

AWS Doc DB not encrypted using Customer Managed Key

Description

This is a simple check to ensure that the DocDB is using AWS key management - KMS to encrypt its contents. To resolve add the ARN of your KMS or link on creation of the cluster.

Fix - Buildtime

Terraform

  • Resource: aws_docdb_cluster
  • Argument: kms_key_id - (Optional) The ARN for the KMS encryption key. When specifying kms_key_id, storage_encrypted needs to be set to true.
resource "aws_docdb_cluster" "docdb" {
  cluster_identifier      = "my-docdb-cluster"
  engine                  = "docdb"
  master_username         = "foo"
  master_password         = "mustbeeightchars"
  backup_retention_period = 5
  preferred_backup_window = "07:00-09:00"
  skip_final_snapshot     = true
+ kms_key_id                        = "ckv_kms"
}

Did this page help you?