logo

Database

Aws Analysis Without Encryption

Description

Detects when AWS Comprehend entity detection jobs are configured without encryption using a KMS key. Unencrypted job outputs could expose sensitive information extracted from analyzed text, including personally identifiable information (PII), since the results are stored without encryption at rest.

Weakness:

165 - Insecure service configuration - AWS

Category: Functionality Abuse

Detection Strategy

    Checks all Comprehend entity detection jobs in the AWS account and region

    Reports a vulnerability when a job's OutputDataConfig does not include a KmsKeyId

    Each unencrypted job will generate a separate vulnerability report with its specific JobArn