Ensure there is one Amazon KMS Customer Master Key (CMK) created in your AWS account for the web tier in order to protect data that transits your AWS web stack, have full control over data encryption/decryption process, and meet compliance requirements. Ideally, the AWS resources within your web tier should have tags such as <web_tier_tag>:<web_tier_tag_value>, where <web_tier_tag> represents the tag name and <web_tier_tag_value> represents the tag value. Prior to running this rule by the Cloud Conformity engine, the web-tier tags must be configured on the Cloud Conformity dashboard, in the rule settings.
This rule can help you with the following compliance standards:
- APRA
- MAS
For further details on compliance standards supported by Conformity, see here.
This rule resolution is part of the Conformity Security & Compliance tool for AWS.
When you use your own AWS KMS Customer Master Key (CMK) to protect the data within your web tier, you gain full control over who can use this key to access the web data, implementing the principle of least privilege on encryption key ownership and usage. The KMS service allows you to easily rotate, audit and even disable the key created for your web tier.
Note: Make sure that you replace all <web_tier_tag>:<web_tier_tag_value> tag placeholders found in the conformity rule content with your own tag name and value created for the web tier.
Audit
To determine if a web-tier KMS Customer Master Key (CMK) exists in your AWS account, perform the following:
Remediation / Resolution
To create a dedicated AWS KMS Customer Master Key (CMK) to be used by AWS resources provisioned within your web tier, perform the following actions:
References
- AWS Documentation
- What is AWS Key Management Service?
- AWS Key Management Service Concepts
- Viewing Keys
- Creating Keys
- Tagging Keys
- CIS Amazon Web Services Foundations
- AWS Command Line Interface (CLI) Documentation
- kms
- list-keys
- list-resource-tags
- create-key
- create-alias
- tag-resource
Unlock the Remediation Steps
Free 30-day Trial
Automatically audit your configurations with Conformity
and gain access to our cloud security platform.
![Confirmity Cloud Platform](/cloudoneconformity/assets/v2/images/common/conformity-platform-cloud.png)
You are auditing:
Web-Tier KMS Customer Master Key (CMK) In Use
Risk Level: Medium