1. Log in to the AWS Management Console and navigate to the AWS Secrets Manager service.
2. Click on the secret that needs to be remediated.
3. Under the “Encryption” section, click on the “Edit” button.
4. Select the “AWS KMS customer master key (CMK)” option.
5. Choose the appropriate CMK from the list or create a new one.
6. Click on the “Save” button to save the changes.
7. Ensure that the secret is now encrypted with the selected CMK by checking the “Encryption” section.

​

1. Open the AWS CLI on your local machine or EC2 instance.
2. Run the following command to list all the secrets in the Secret Manager:
   aws secretsmanager list-secrets
   
3. Note down the ARN of the secret that needs to be encrypted with a CMK.
4. Create a new KMS customer managed key (CMK) by running the following command:
   aws kms create-key --description "My new CMK"
   
5. Note down the ARN of the newly created CMK.
6. Run the following command to update the secret to use the newly created CMK:
   aws secretsmanager update-secret-version-stage --secret-id <ARN-of-secret> --secret-version-stage AWSCURRENT --kms-key-id <ARN-of-new-CMK>
   
   Replace <ARN-of-secret> with the ARN of the secret that needs to be encrypted with a CMK, and <ARN-of-new-CMK> with the ARN of the newly created CMK.
7. Verify that the secret is now encrypted with the new CMK by running the following command:
   aws secretsmanager describe-secret --secret-id <ARN-of-secret>
   
   This command should return the details of the secret, including the KMS key ID.

1. Create a Customer Managed Key (CMK) in AWS Key Management Service (KMS) if not already created.

import boto3

kms_client = boto3.client('kms')

response = kms_client.create_key(
    Description='CMK for Secret Manager',
    KeyUsage='ENCRYPT_DECRYPT',
    Origin='AWS_KMS'
)

cmk_arn = response['KeyMetadata']['Arn']

2. Enable Key Rotation for the CMK created in step 1.

import boto3

kms_client = boto3.client('kms')

kms_client.enable_key_rotation(
    KeyId='CMK_ARN'
)

3. Update the Secrets in AWS Secret Manager to use the CMK created in step 1 for encryption.

import boto3

secrets_client = boto3.client('secretsmanager')

response = secrets_client.update_secret(
    SecretId='SECRET_NAME',
    KmsKeyId='CMK_ARN',
    SecretString='{"username":"admin","password":"secret"}'
)

resource "aws_secretsmanager_secret" "new_cmk_encrypted_secret" {
  # Replace with a unique name for the new secret
  name = "NEW_SECRET_NAME_FOR_ASSET_LABEL"

  # Replace with the ARN of your customer-managed KMS key
  kms_key_id = "KMS_CMK_KEY_ARN"

  description              = "CMK-encrypted replacement for OLD_SECRET_NAME"
  recovery_window_in_days  = 7
}

• NEW_SECRET_NAME_FOR_ASSET_LABEL with the new secret name you want.
• KMS_CMK_KEY_ARN with the ARN of your customer-managed KMS key.