CMK is unusable

This product is not supported for your selected Datadog site. ().
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Metadata

Id: 7350fa23-dcf7-4938-916d-6a60b0c73b50

Cloud Provider: aws

Framework: Terraform

Severity: Medium

Category: Availability

Learn More

Description

This check ensures that AWS Key Management Service (KMS) Customer Master Keys (CMKs) are configured with the is_enabled attribute set to TRUE, making them usable for cryptographic operations such as encryption and decryption. If this attribute is set to FALSE, the CMK becomes unusable, preventing applications and services from accessing encrypted data or generating new data keys. Leaving CMKs disabled can disrupt access to critical resources and services, potentially resulting in application outages, data unavailability, or failed backup and restore operations. Properly enabling CMKs is crucial to maintaining secure and continuous access to resources that depend on AWS KMS.

Compliant Code Examples

resource "aws_kms_key" "a3" {
  description             = "KMS key 1"
  is_enabled = true
}

Non-Compliant Code Examples

resource "aws_kms_key" "a" {
  description             = "KMS key 1"
  is_enabled = false
}