1.1 Ensure a customer created Customer Master Key (CMK) is created for the Web-tier

Information

AWS Key Management Service (KMS) by default provides service Customer Managed Keys (CMK). Customers also have the ability to create CMKs, which allows for configuration of key rotation and key policy which is applied to the customer created CMK.

You can use the key policy by itself to control who has access to the CMK and what actions each identity can perform. Controlling access this way specifies the full scope of access to the CMK in a single document (the key policy).

Customer created CMKs can be used for:

* AWS Service level encryption(e.g. EBS, RDS, S3)
* Key management for file/application level encryption
Ensures principle of least privilege on key ownership & usage

Solution

Using the Amazon unified command line interface:

* If there is no alias listed for Web tier, create new KMS key and note the "KeyId" element:

aws kms create-key

* Create an alias for the Web tier key using the above KeyId:

aws kms create-alias --alias-name _<web_tier_kms_alias>_ --target-key-id _<web_tier_kms_key>_

See Also

https://workbench.cisecurity.org/files/260