AWS DLM cross-region events are not encrypted with a Customer Managed Key (CMK)

Description

This policy identifies DLM cross-region events) which are encrypted with default KMS keys and not with Keys managed by Customer. It is a best practice to use customer managed KMS Keys to encrypt your DLM cross-region events data. It gives you full control over the encrypted data.

Code Example

resource "aws_dlm_lifecycle_policy" "pass" {
  description        = "tf-acc-basic"
  execution_role_arn = aws_iam_role.example.arn

  policy_details {
    policy_type = "EVENT_BASED_POLICY"

    resource_types = []
    target_tags    = {}

    action {
      name = "tf-acc-basic"
      cross_region_copy {
        encryption_configuration {
          cmk_arn    = aws_kms_key.test.arn
          encryption = true
        }
        retain_rule {
          interval      = 15
          interval_unit = "MONTHS"
        }

      }
    }

    event_source {
      type = "MANAGED_CWE"
      parameters {
        description_regex = "^.*Created for policy: policy-1234567890abcdef0.*$"
        event_type        = "shareSnapshot"
        snapshot_owner    = [data.aws_caller_identity.current.account_id]
      }
    }
  }
}

Remediation

Terraform

• Resource: aws_dlm_lifecycle_policy
• Arguments: action.cross_region_copy.encryption_configuration.cmk_arn

Rule Details

Field	Value
ID	IAC-0302
Severity	LOW
IaC Type	Terraform
Frameworks	Terraform
Checkov ID	CKV_AWS_254

References

• Checkov Rule

---