Metadata

Id: terraform-aws-cmk-is-unusable

Provider: AWS

Platform: Terraform

Severity: Medium

Category: Availability

Learn More

• Provider Reference

Description

This check ensures that AWS Key Management Service (KMS) Customer Master Keys (CMKs) are configured with the is_enabled attribute set to TRUE, making them usable for cryptographic operations such as encryption and decryption. If this attribute is set to FALSE, the CMK becomes unusable, preventing applications and services from accessing encrypted data or generating new data keys. Leaving CMKs disabled can disrupt access to critical resources and services, potentially resulting in application outages, data unavailability, or failed backup and restore operations. Properly enabling CMKs is crucial to maintaining secure and continuous access to resources that depend on AWS KMS.

Compliant Code Examples

resource "aws_kms_key" "a3" {
  description             = "KMS key 1"
  is_enabled = true
}

Non-Compliant Code Examples

resource "aws_kms_key" "a" {
  description             = "KMS key 1"
  is_enabled = false
}