# Ensure Kubernetes Secrets are encrypted using Customer Master Keys (CMKs)

- Source: https://support.icompaas.com/support/solutions/articles/62000229619-ensure-kubernetes-secrets-are-encrypted-using-customer-master-keys-cmks-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [General](https://support.icompaas.com/support/solutions/62000037933) › [Policy Updates](https://support.icompaas.com/support/solutions/folders/62000168784)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Kubernetes secrets are pieces of sensitive data that are stored in a cluster. They can be used to store things like passwords, API keys, and other confidential information. By encrypting Kubernetes secrets, you can help to protect them from unauthorized access.

**Rationale**

There are several reasons why you should encrypt Kubernetes secrets. First, it helps to protect your data from unauthorized access. If an attacker were to gain access to your cluster, they would not be able to decrypt your secrets without the encryption key. Second, encrypting your secrets can help to meet compliance requirements. Many compliance standards, such as PCI DSS and HIPAA, require that sensitive data be encrypted.

**Impact**

Encrypting Kubernetes secrets has several positive impacts. First, it can help to protect your data from unauthorized access. Second, it can help to meet compliance requirements. Third, it can help to improve the security of your cluster.

**Default Value**

By default, Kubernetes secrets are not encrypted. However, you can enable encryption by creating a Customer Master Key (CMK) in AWS Key Management Service (KMS) and then configuring your cluster to use that key.

**Pre-requisites**

To encrypt Kubernetes secrets, you will need the following:

-   An AWS account
-   An IAM user or role with permissions to create and manage CMKs
-   A Kubernetes cluster that is version 1.13 or higher

**Remediation Steps**

To remediate this policy, you will need to encrypt your Kubernetes secrets using a CMK. Here are the steps involved:

1.  Create a CMK in AWS KMS.
2.  Configure your Kubernetes cluster to use the CMK.
3.  Encrypt your secrets using the CMK.

**Test Plan**

To test that your Kubernetes secrets are encrypted, you can use the following steps:

1.  Create a new secret.
2.  Encrypt the secret using the CMK.
3.  Verify that the secret is encrypted by trying to access it without the encryption key.

**Implementation Plan**

The implementation plan for this policy is as follows:

1.  Create a CMK in AWS KMS.
2.  Configure your Kubernetes cluster to use the CMK.
3.  Encrypt your secrets using the CMK.

**AWS CLI Process**

To encrypt Kubernetes secrets using the AWS CLI, you can use the following command:

```
aws kms encrypt --key-id <key-id> --plaintext <plaintext> --output text --query CiphertextBlob
```

**Using AWS GUI**

To encrypt Kubernetes secrets using the AWS GUI, you can follow these steps:

1.  Go to the AWS KMS console.
2.  Click on "Create Key".
3.  Select the "Customer Master Key (CMK)" option.
4.  Click on "Next: Configure Key".
5.  Select the "Encrypt" option.
6.  Click on "Next: Tags".
7.  Add any tags that you want to associate with the key.
8.  Click on "Next: Review".
9.  Review the key configuration and click on "Create".
10.  Once the key is created, you can use it to encrypt your Kubernetes secrets.

**Backout Plan**

To backout of this policy, you can simply delete the CMK that you created. This will cause all of your encrypted secrets to be unencrypted.

**Note**

This policy does not apply to Kubernetes secrets that are stored in AWS Secrets Manager. Secrets Manager automatically encrypts all secrets that are stored in it.

**Reference**

-   AWS KMS documentation: https://docs.aws.amazon.com/kms/latest/developerguide/
-   Kubernetes secrets documentation: https://kubernetes.io/docs/concepts/configuration/secret/

**Section 2: Tags and Keywords**

-   Tags: encryption, secrets, KMS, CMK
-   Keywords: Kubernetes, security, compliance

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.