Storage Gateway file share is encrypted with KMS CMK

Check ID: storagegateway_fileshare_encryption_enabled
Provider: AWS
Service: storagegateway
Severity: MEDIUM
Categories: encryption
Resource type: Other

What this check verifies

Storage Gateway file shares configured with customer-managed KMS keys (CMKs) for server-side encryption of objects written to S3. File shares without an explicit KMS key (e.g., SSE-KMS or DSSE-KMS) are identified.

Risk

Without CMEK, encryption relies on provider-managed keys, reducing control over who can decrypt and when. This weakens confidentiality by limiting key-policy enforcement, revocation, and auditable key use, increasing exposure from stolen S3 credentials or overly permissive roles.

Recommendation

Use a customer-managed KMS key for each file share’s server-side encryption (SSE-KMS; consider DSSE-KMS for multilayer needs). Apply least privilege and separation of duties to key access, rotate keys, monitor key usage, and restrict scope to necessary principals and regions.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws storagegateway update-nfs-file-share —file-share-arn <example_resource_arn> —kms-encrypted —kms-key <example_kms_key_arn>

# Enable KMS CMK encryption for a Storage Gateway NFS file share
resource "aws_storagegateway_nfs_file_share" "<example_resource_name>" {
  client_list  = ["<example_cidr_block>"]
  gateway_arn  = "<example_resource_arn>"
  location_arn = "<example_resource_arn>"
  role_arn     = "<example_resource_arn>"

  kms_encrypted = true              # Critical: enables KMS CMK encryption
  kms_key_arn   = "<example_kms_key_arn>"  # Critical: CMK ARN used for encryption
}

# CloudFormation: enable KMS CMK encryption for a Storage Gateway NFS file share
Resources:
  <example_resource_name>:
    Type: AWS::StorageGateway::NFSFileShare
    Properties:
      ClientToken: "<example_resource_id>"
      GatewayARN: "<example_resource_arn>"
      LocationARN: "<example_resource_arn>"
      Role: "<example_resource_arn>"
      KMSEncrypted: true  # Critical: enables KMS CMK encryption for the file share
      KMSKey: "<example_kms_key_arn>"  # Critical: CMK ARN used for encryption

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = storagegateway_fileshare_encryption_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Step Functions state machine definition has no secrets AWS Storage Gateway gateway is not hosted on EC2

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires