Secrets stored in AWS Secrets Manager should explicitly specify a customer-managed KMS key to ensure you control key policies, enable audited key usage, and allow cross-account access when required.
For AWS::SecretsManager::Secret resources, Properties.KmsKeyId must be defined and should reference a customer-managed KMS key (key ARN, alias, or a Ref/GetAtt to an AWS::KMS::Key). Omitting KmsKeyId causes Secrets Manager to use the AWS-managed key, which does not support granting cross-account decrypt permissions. If you need to share secrets across accounts, ensure the referenced KMS key’s policy grants the necessary kms:Decrypt and kms:GenerateDataKey permissions to the target principals. Resources missing KmsKeyId will be flagged.
Secure configuration example:
MyKmsKey:Type:AWS::KMS::KeyProperties:Description:KMS key for Secrets ManagerMySecret:Type:AWS::SecretsManager::SecretProperties:Name:my-secretKmsKeyId:!Ref MyKmsKey
Compliant Code Examples
AWSTemplateFormatVersion:2010-09-09Description:A sample templateResources:SecretsManagerSecret:Type:AWS::SecretsManager::SecretProperties:Description:StringGenerateSecretString:GenerateSecretStringKmsKeyId:StringName:StringSecretString:StringTags:- Tag
Non-Compliant Code Examples
AWSTemplateFormatVersion:2010-09-09Description:A sample templateResources:SecretsManagerSecret:Type:AWS::SecretsManager::SecretProperties:Description:StringGenerateSecretString:GenerateSecretStringName:StringSecretString:StringTags:- Tag
1
2
rulesets:- CloudFormation / AWS # Rules to enforce / AWS.
맞춤형 데모 요청
Datadog 시작하기
Ask AI
AI-generated responses may be inaccurate. Verify important info.
