01 Define the required IAM policy that enables the selected IAM users and/or roles to administer the new customer-managed CMK and to encrypt/decrypt AWS Secrets Manager data using the KMS API. Create a new policy document, name it secrets-cmk-iam-policy.json, and paste the following content (replace the highlighted details, i.e. the ARNs of the IAM users and/or roles, with your own IAM details):
{
"Version": "2012-10-17",
"Id": "aws-secrets-manager-cmk-policy",
"Statement": [
{
"Sid": "Enable IAM User Permissions",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:root"
},
"Action": "kms:*",
"Resource": "*"
},
{
"Sid": "Grant access to CMK manager",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:role/cc-secrets-manager"
},
"Action": [
"kms:Create*",
"kms:Describe*",
"kms:Enable*",
"kms:List*",
"kms:Put*",
"kms:Update*",
"kms:Revoke*",
"kms:Disable*",
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
],
"Resource": "*"
},
{
"Sid": "Allow the use of the CMK",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:user/cc-secrets-admin"
},
"Action": [
"kms:Encrypt",
"kms:Decrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*",
"kms:DescribeKey"
],
"Resource": "*"
},
{
"Sid": "Allow attachment of persistent resources",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:user/cc-secrets-admin"
},
"Action": [
"kms:CreateGrant",
"kms:ListGrants",
"kms:RevokeGrant"
],
"Resource": "*",
"Condition": {
"Bool": {
"kms:GrantIsForAWSResource": "true"
}
}
}
]
}
02 Run create-key command (OSX/Linux/UNIX) using the file name of the policy document created at the previous step (i.e. secrets-cmk-iam-policy.json) as command parameter to create the new Amazon KMS CMK:
aws kms create-key
--region us-east-1
--description 'Customer-managed CMK for AWS Secrets Manager secrets'
--policy file://secrets-cmk-iam-policy.json
03 The command output should return the new KMS CMK metadata. Copy the CMK Amazon Resource Name (Arn parameter value – highlighted) as this ID will be required later when you have to specify the key required for AWS Secrets Manager data encryption:
{
"KeyMetadata": {
"Origin": "AWS_KMS",
"KeyId": "abcd1234-1234-abcd-1234-abcd1234abcd",
"Description": "Customer-managed CMK for AWS Secrets Manager secrets",
"Enabled": true,
"KeyUsage": "ENCRYPT_DECRYPT",
"KeyState": "Enabled",
"CreationDate": 1517238743.120,
"Arn": "arn:aws:kms:us-east-1:123456789012:key/12345678-abcd-1234-abcd-12345678abcd",
"AWSAccountId": "123456789012"
}
}
04 Run create-alias command (OSX/Linux/UNIX) using the key ARN returned at the previous step to attach an alias to the new CMK. The alias must start with the prefix "alias/" (the command does not produce an output):
aws kms create-alias
--region us-east-1
--alias-name alias/secrets-manager-data-cmk
--target-key-id arn:aws:kms:us-east-1:123456789012:key/12345678-abcd-1234-abcd-12345678abcd
05 Run update-secret command (OSX/Linux/UNIX) using the name of the Amazon Secrets Manager secret that you want to reconfigure as identifier (see Audit section part II to identify the right resource) and the ARN of the KMS Customer Master Key (CMK) created earlier as parameter, to update the configuration of the selected secret with the specified KMS key:
aws secretsmanager update-secret
--region us-east-1
--secret-id cc-prod-db-credentials
--kms-key-id arn:aws:kms:us-east-1:123456789012:key/12345678-abcd-1234-abcd-12345678abcd
06 The command output should return the reconfigured AWS Secrets Manager secret metadata:
{
"Name": "cc-prod-db-credentials",
"ARN": "arn:aws:secretsmanager:us-east-1:123456789012:secret:cc-prod-db-credentials-ABC123"
}
07 Repeat steps no. 5 and 6 for each Amazon Secrets Manager secret that you want to encrypt using your custom KMS CMK, available in the selected AWS region.
08 Change the AWS region by updating the --region command parameter value and repeat the entire remediation/resolution process for other regions.
Security