DOCDB Cluster Without KMS

  • Query id: 4766d3ea-241c-4ee6-93ff-c380c996bd1a
  • Query name: DOCDB Cluster Without KMS
  • Platform: Terraform
  • Severity: High
  • Category: Encryption
  • URL: Github

Description

AWS DOCDB Cluster should be encrypted with a KMS encryption key
Documentation

Code samples

Code samples with security vulnerabilities

Postitive test num. 1 - tf file
resource "aws_docdb_cluster" "docdb" {
  cluster_identifier      = "my-docdb-cluster"
  engine                  = "docdb"
  master_username         = "foo"
  master_password         = "mustbeeightchars"
  backup_retention_period = 5
  preferred_backup_window = "07:00-09:00"
  skip_final_snapshot     = true
}

Code samples without security vulnerabilities

Negative test num. 1 - tf file
resource "aws_docdb_cluster" "docdb" {
  cluster_identifier      = "my-docdb-cluster"
  engine                  = "docdb"
  master_username         = "foo"
  master_password         = "mustbeeightchars"
  backup_retention_period = 5
  preferred_backup_window = "07:00-09:00"
  skip_final_snapshot     = true
  storage_encrypted = true
  kms_key_id = "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
}