Severity Framework
Snyk CCSS
Rule category
Data / Encryption at Rest
Is your enviroment affected by this misconfiguration?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsFrameworks
- Snyk ID SNYK-CC-00810
- credit Snyk Research Team
Description
Enforcing the use of customer-managed encryption keys (CMEK) on Filestore instances ensures that data at rest is encrypted with keys controlled by the organization, mitigating the risk of unauthorized data access and ensuring compliance with data protection regulations. Without CMEK, the default Google-managed encryption keys are used, which may not meet certain organizational or regulatory encryption requirements.
How to fix?
Set the kms_key_name
attribute in google_filestore_instance
resource to valid kms key.
Example Configuration
resource "google_filestore_instance" "instance" {
name = "snyk-instance"
location = "us-east1"
tier = "ENTERPRISE"
file_shares {
capacity_gb = 1024
name = "share1"
}
networks {
network = "default"
modes = ["MODE_IPV4"]
}
kms_key_name = google_kms_crypto_key.filestore_key.id
}