Secrets Manager secrets should be encrypted using CMK

This rule specifies that Secrets Manager secrets must be encrypted using Customer Master Keys (CMK) to ensure data security.

Rule	Secrets Manager secrets should be encrypted using CMK
Framework	NIST 800-53 Revision 5
Severity	✔ High

Rule Description:

The rule requires that all secrets stored in AWS Secrets Manager should be encrypted using a Customer Master Key (CMK) that complies with the encryption standards defined in NIST 800-53 Revision 5.

Troubleshooting Steps:

If you encounter any issues while implementing this rule, follow the troubleshooting steps below:

1.

Invalid encryption key: Verify that the CMK being used for encrypting the Secrets Manager secrets is compliant with NIST 800-53 Revision 5. If not, create a new CMK or update the existing CMK to meet the required standards.

2.

Misconfigured access permissions: Ensure that the IAM policies and roles associated with the CMK have appropriate access permissions to encrypt and decrypt the secrets stored in AWS Secrets Manager.

3.

Secrets not encrypted: Check whether there are any secrets in AWS Secrets Manager that are not encrypted using a CMK. Encrypt these secrets using a CMK that complies with NIST 800-53 Revision 5.

Code Snippets:

If you prefer to use code to implement this rule, use the following AWS CLI commands to create or update a CMK and encrypt secrets in AWS Secrets Manager.

1.
Create a CMK:

aws kms create-key --description "CMK for NIST 800-53 Revision 5" --key-usage ENCRYPT_DECRYPT

1.
Update an existing CMK policy:

aws kms put-key-policy --key-id <key-id> --policy-name default --policy '{
  "Version": "2012-10-17",
  "Id": "key-policy",
  "Statement": [
    {
      "Sid": "Enable IAM User Permissions",
      "Effect": "Allow",
      "Principal": {
        "AWS": "<IAM User ARN>"
      },
      "Action": "kms:*",
      "Resource": "*"
    }
  ]
}'

Note: Replace

<key-id>

with the actual CMK ID and

<IAM User ARN>

with the ARN of the IAM user that requires access to the CMK.

1.
Encrypt a secret using a CMK:

aws secretsmanager update-secret --secret-id <secret-id> --kms-key-id <key-id>

Note: Replace

<secret-id>

with the actual ID of the secret and

<key-id>

with the CMK ID used for encryption.

Remediation Steps:

To remediate any non-compliant secrets in AWS Secrets Manager, follow the step-by-step guide below:

1.

Identify the secrets that are not encrypted using a CMK that complies with NIST 800-53 Revision 5.

2.

Create or update a CMK to meet the encryption standards defined in NIST 800-53 Revision 5.

3.

Update the CMK policy to grant appropriate access permissions to IAM users or roles.

4.

Encrypt the non-compliant secrets using the CMK that meets the required standards.

5.

Regularly monitor and audit the encryption status of secrets in AWS Secrets Manager to ensure ongoing compliance with the rule.

Remember to regularly review and update the CMK and associated policies to align with any changes or updates in encryption standards specified in NIST 800-53 Revision 5.

Secrets Manager secrets should be encrypted using CMK

Is your System Free of Underlying Vulnerabilities? Find Out Now

Is your System Free of Underlying Vulnerabilities?
Find Out Now