Homepage

Filestore instances must use Customer-Managed encryption keys Affecting Filestore service in Google

Severity

0.0
medium
0
10
Severity Framework
Snyk CCSS
Rule category
Data/ Encryption at Rest

Is your environment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
Frameworks
  • Snyk IDSNYK-CC-00810
  • creditSnyk Research Team
Report a new misconfiguration Found a mistake?

Description

Enforcing the use of customer-managed encryption keys (CMEK) on Filestore instances ensures that data at rest is encrypted with keys controlled by the organization, mitigating the risk of unauthorized data access and ensuring compliance with data protection regulations. Without CMEK, the default Google-managed encryption keys are used, which may not meet certain organizational or regulatory encryption requirements.

How to fix?

Set the kms_key_name attribute in google_filestore_instance resource to valid kms key.

Example Configuration


resource "google_filestore_instance" "instance" {
  name     = "snyk-instance"
  location = "us-east1"
  tier     = "ENTERPRISE"

  file_shares {
    capacity_gb = 1024
    name        = "share1"
  }

  networks {
    network = "default"
    modes   = ["MODE_IPV4"]
  }

  kms_key_name = google_kms_crypto_key.filestore_key.id
}