Is kms_key_id enforced for PCI DSS v4.0?

Yes, Ensure that all secrets in AWS Secrets Manager are encrypted using the AWS managed key (aws/secretsmanager) or a customer managed key that was created in AWS Key Management Service (AWS KMS). The rule is compliant if a secret is encrypted using a customer managed key. This rule is non-compliant if a secret is encrypted using aws/secretsmanager.

terraform-aws-modules/secrets-manager/aws for PCI DSS v4.0

Registry

Sign inStart free trial

Controls

1 control from PCI DSS v4.0 apply to this module.

Control	Clause	Change
Secrets Manager secrets should be encrypted using CMKsecretsmanager_secret_encrypted_with_kms_cmk 8.3.2	8.3.2