Create new_ebs.tf

[mikeurbanski1]

No description provided.

[prisma-cloud-devsecops]

Prisma Cloud has found errors in this PR ⬇️

[prisma-cloud-devsecops]

Suggested change

	encrypted = false
	encrypted = true

  AWS EBS volumes are not encrypted
    Resource: aws_ebs_volume.v | ID: BC_AWS_GENERAL_3

Description

Encrypting EBS volumes ensures that replicated copies of your images are secure even if they are accidentally exposed. AWS EBS encryption uses AWS KMS customer master keys (CMK) when creating encrypted volumes and snapshots. Storing EBS volumes in their encrypted state reduces the risk of data exposure or data loss. We recommend you encrypt all data stored in the EBS.

Benchmarks

• PCI-DSS V3.2.1 3.4
• PCI-DSS V3.2 3
• NIST-800-53 SC-2
• FEDRAMP (MODERATE) SC-28

[prisma-cloud-devsecops]

  AWS EBS Volume not encrypted using Customer Managed Key
    Resource: aws_ebs_volume.v | ID: BC_AWS_GENERAL_109

How to Fix

resource "aws_ebs_volume" "example" {
  availability_zone = "us-west-2a"
  size              = 40
+ kms_key_id = "ckv_kms"
  tags = {
    Name = "HelloWorld"
  }
}

Description

Amazon EBS automatically creates a unique AWS managed key in each Region where you store AWS resources. This KMS key has the alias alias/aws/ebs. By default, Amazon EBS uses this KMS key for encryption. Alternatively, you can specify a symmetric customer managed key that you created as the default KMS key for EBS encryption. Using your own KMS key gives you more flexibility, including the ability to create, rotate, and disable KMS keys.