Triage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration “PubSub Topics Should Be Encrypted Using CMEK” for GCP using GCP console, you can follow the below steps:
- Login to your GCP console.
- Navigate to the Pub/Sub page from the left-hand side menu.
- Select the topic that you want to encrypt using CMEK.
- Click on the “Edit” button present at the top of the page.
- Scroll down to the “Encryption” section.
- Click on the “Enable encryption” checkbox.
- Select the “Customer-managed key” option from the dropdown.
- Choose the CMEK key that you want to use for encryption from the “Key name” dropdown.
- Click on the “Save” button to save the changes.
Using CLI
Using CLI
To remediate the misconfiguration in GCP using GCP CLI, follow these steps:Replace The output should include the following line:This indicates that the topic is now encrypted using a customer-managed encryption key (CMEK).
- Open the Cloud Shell in the GCP Console.
- Set the project where the Pub/Sub topic is located:
- Retrieve the list of Pub/Sub topics in the project:
- For each topic that does not have encryption enabled, enable encryption using the following command:
[TOPIC_NAME] with the name of the Pub/Sub topic that needs to be encrypted, and replace [PROJECT_ID], [LOCATION], [KEYRING_NAME], and [KEY_NAME] with the appropriate values for your project.- Verify that the encryption has been enabled for the topic by running the following command:
Using Python
Using Python
To remediate the misconfiguration where PubSub topics should be encrypted using CMEK in GCP using Python, you can follow these step-by-step instructions:These steps will help you remediate the misconfiguration where PubSub topics should be encrypted using CMEK in GCP using Python.
- First, ensure that you have the necessary permissions to create a new key ring and key in the Cloud KMS service.
- Next, you will need to create a new key ring and key in the Cloud KMS service. You can do this using the following Python code:
- Once you have created the key ring and key, you can use it to encrypt your PubSub topics. You can do this using the following Python code:
- Finally, you can verify that your PubSub topic is encrypted using CMEK by checking the topic details in the GCP Console or by using the following Python code: