Policy: AWS > EFS > FileSystem > Approved > Encryption at Rest > Customer Managed Key
Define the KMS key ID for encryption at rest.
Encryption at Rest refers specifically to the encryption of data when written to an underlying storage system. This control determines whether the resource is encrypted at rest, and sets encryption to your desired level.
The Encryption at Rest control compares the encryption settings against the encryption policies for the resource (AWS > EFS > FileSystem > Encryption at Rest > *
), raises an alarm, and takes the defined enforcement action
Please make sure the key defined in the template has required permissions.example: alias/aws/ebs ddc06e04-ce5f-4995-c758-c2b6c510e8fd arn:aws:kms:us-east-1:123456789012:key/ddc06e04-ce5f-4995-c758-c2b6c510e8fd arn:aws:kms:us-east-1:123456789012:alias/aws/ebs
Resource Types
This policy targets the following resource types:
Primary Policy
This policy is used with the following primary policy:
Controls
Policy Packs
This policy setting is used by the following policy packs:
Policy Specification
Default template |
|
---|---|
Default template input |
|
Category
In Your Workspace
Developers
- tmod:@turbot/turbot#/control/categories/resourceEncryptionAtRest
- tmod:@turbot/aws-efs#/policy/types/fileSystemEncryptionAtRestCustomerManagedKey
- turbot graphql policy-type --id "tmod:@turbot/aws-efs#/policy/types/fileSystemEncryptionAtRestCustomerManagedKey"
- turbot graphql policy-settings --filter "policyTypeId:tmod:@turbot/aws-efs#/policy/types/fileSystemEncryptionAtRestCustomerManagedKey"
Get Policy TypeGet Policy Settings