DocumentDB cluster encrypted with AWS managed key

Ce produit n'est pas pris en charge par le site Datadog que vous avez sélectionné. ().
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Metadata

Id: terraform-aws-docdb-cluster-encrypted-with-aws-managed-key

Provider: AWS

Platform: Terraform

Severity: Low

Category: Encryption

Learn More

Description

Amazon DocumentDB clusters should be encrypted using customer-managed AWS Key Management Service (KMS) keys rather than default AWS-managed keys. When the kms_key_id attribute in the aws_docdb_cluster resource is set to an AWS-managed key such as alias/aws/rds, as in the configuration below, it limits the organization’s ability to control, rotate, and audit the usage of encryption keys, potentially weakening the security posture:

data "aws_kms_key" "test" {
  key_id = "alias/aws/rds"
}

resource "aws_docdb_cluster" "test2" {
  ...
  storage_encrypted   = true
  kms_key_id          = data.aws_kms_key.test.arn
}

If this misconfiguration is left unaddressed, sensitive data stored in the DocumentDB cluster may be at risk because AWS retains full control of the KMS key, making it difficult to restrict or monitor access and respond to compliance requirements. Using customer-managed KMS keys allows for finer-grained access control, detailed key usage logging, and key lifecycle management, helping protect data from unauthorized access and achieving regulatory compliance.

Compliant Code Examples

provider "aws" {
  region = "us-east-1"
}

data "aws_kms_key" "test2" {
  key_id = "alias/myAlias"
}

resource "aws_docdb_cluster" "test22" {
  cluster_identifier  = "my-docdb-cluster-test2"
  engine              = "docdb"
  master_username     = "foo"
  master_password     = "mustbeeightchars"
  skip_final_snapshot = true
  storage_encrypted   = true
  kms_key_id          = data.aws_kms_key.test2.arn
}

Non-Compliant Code Examples

provider "aws" {
  region = "us-east-1"
}

resource "aws_docdb_cluster" "test2" {
  cluster_identifier  = "my-docdb-cluster-test2"
  engine              = "docdb"
  master_username     = "foo"
  master_password     = "mustbeeightchars"
  skip_final_snapshot = true
  storage_encrypted   = true
  kms_key_id          = "alias/aws/rds"
}

# kms_key_id set via a data source reference (data.aws_kms_key.test.arn).
# See positive4.json, a real terraform plan for this exact configuration
# (data sources requiring a live provider call still produce a usable
# plan JSON even when that call fails, since Terraform can't compute any
# attribute of aws_docdb_cluster.test2 without the resolved key, so the
# whole resource drops out of planned_values, but
# configuration.root_module.resources keeps its unevaluated expressions
# regardless). Detected via
# tf_lib.uses_aws_managed_key_data_source_ref_config_only.
provider "aws" {
  region = "us-east-1"
}

data "aws_kms_key" "test" {
  key_id = "alias/aws/rds"
}

resource "aws_docdb_cluster" "test2" {
  cluster_identifier  = "my-docdb-cluster-test2"
  engine              = "docdb"
  master_username     = "foo"
  master_password     = "mustbeeightchars"
  skip_final_snapshot = true
  storage_encrypted   = true
  kms_key_id          = data.aws_kms_key.test.arn
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_docdb_cluster" "test3" {
  cluster_identifier  = "my-docdb-cluster-test3"
  engine              = "docdb"
  master_username     = "foo"
  master_password     = "mustbeeightchars"
  skip_final_snapshot = true
  storage_encrypted   = true
  kms_key_id          = "arn:aws:kms:us-east-1:123456789012:alias/aws/rds"
}