Homepage

AppSync cache data is not encrypted at rest Affecting AppSync service in AWS

Severity

0.0
medium
0
10
Severity Framework
Snyk CCSS
Rule category
Data/ Encryption at Rest

Is your environment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
Frameworks
  • Snyk IDSNYK-CC-00736
  • creditSnyk Research Team
Report a new misconfiguration Found a mistake?

Description

Unencrypted data at rest in the AppSync cache increases the risk of unauthorized access and data leakage. Ensure that data stored in the cache is encrypted at rest to protect sensitive information.

How to fix?

Set the at_rest_encryption_enabled attribute to true in the aws_appsync_api_cache resource.

Example Configuration

resource "aws_appsync_graphql_api" "allowed" {
  authentication_type = "API_KEY"
  name                = "allowed1"
}

resource "aws_appsync_api_cache" "allowed1" {
  api_id                     = aws_appsync_graphql_api.allowed.id
  api_caching_behavior       = "FULL_REQUEST_CACHING"
  type                       = "SMALL"
  ttl                        = 900
  at_rest_encryption_enabled = true
  transit_encryption_enabled = true
}