FSx file system should use a customer-managed KMS key for encryption

What it checks

FSx file system: no customer-managed KMS key is configured.

Where it applies

Terraform: aws_fsx_windows_file_system, aws_fsx_lustre_file_system, aws_fsx_ontap_file_system, aws_fsx_openzfs_file_system

CloudFormation: AWS::FSx::FileSystem

How to fix it

1. Create a KMS CMK and set kms_key_id at FSx file system creation. Note: KMS key cannot be changed after creation — requires new file system.
2. For Lustre, scratch file systems are already encrypted with service-managed keys and cannot select a customer-managed key. If customer-key control is required, create a new file system using PERSISTENT_1 or PERSISTENT_2 and select kms_key_id at creation; plan data migration and replacement before deployment.

Frameworks

• SOC 2 CC6.1
• HIPAA 164.312(a)(2)(iv)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules