Homepage
About Snyk

Filestore instances must use Customer-Managed encryption keys Affecting Filestore service in Google

0.0
medium
0
10
    Severity Framework Snyk CCSS
    Rule category Data / Encryption at Rest

Is your enviroment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
    Frameworks
  • Snyk ID SNYK-CC-00810
  • credit Snyk Research Team
Report a new misconfiguration Found a mistake?

Description

Enforcing the use of customer-managed encryption keys (CMEK) on Filestore instances ensures that data at rest is encrypted with keys controlled by the organization, mitigating the risk of unauthorized data access and ensuring compliance with data protection regulations. Without CMEK, the default Google-managed encryption keys are used, which may not meet certain organizational or regulatory encryption requirements.

How to fix?

Set the kms_key_name attribute in google_filestore_instance resource to valid kms key.

Example Configuration


resource "google_filestore_instance" "instance" {
  name     = "snyk-instance"
  location = "us-east1"
  tier     = "ENTERPRISE"

  file_shares {
    capacity_gb = 1024
    name        = "share1"
  }

  networks {
    network = "default"
    modes   = ["MODE_IPV4"]
  }

  kms_key_name = google_kms_crypto_key.filestore_key.id
}