Back to Checks
aws

Storage Gateway file share is encrypted with KMS CMK

storagegateway_fileshare_encryption_enabled
Service: storagegatewaySeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:Other

Storage Gateway file shares configured with customer-managed KMS keys (CMKs) for server-side encryption of objects written to S3.

File shares without an explicit KMS key (e.g., SSE-KMS or DSSE-KMS) are identified.

Prowler logoProwlerprowler-provider-aws

Risk

Without CMEK, encryption relies on provider-managed keys, reducing control over who can decrypt and when. This weakens confidentiality by limiting key-policy enforcement, revocation, and auditable key use, increasing exposure from stolen S3 credentials or overly permissive roles.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks storagegateway_fileshare_encryption_enabled

Recommendation

Use a customer-managed KMS key for each file share's server-side encryption (SSE-KMS; consider DSSE-KMS for multilayer needs). Apply least privilege and separation of duties to key access, rotate keys, monitor key usage, and restrict scope to necessary principals and regions.

Remediation

CLI

aws storagegateway update-nfs-file-share --file-share-arn <example_resource_arn> --kms-encrypted --kms-key <example_kms_key_arn>

Terraform

# Enable KMS CMK encryption for a Storage Gateway NFS file share
resource "aws_storagegateway_nfs_file_share" "<example_resource_name>" {
  client_list  = ["<example_cidr_block>"]
  gateway_arn  = "<example_resource_arn>"
  location_arn = "<example_resource_arn>"
  role_arn     = "<example_resource_arn>"

  kms_encrypted = true              # Critical: enables KMS CMK encryption
  kms_key_arn   = "<example_kms_key_arn>"  # Critical: CMK ARN used for encryption
}

NativeIaC

# CloudFormation: enable KMS CMK encryption for a Storage Gateway NFS file share
Resources:
  <example_resource_name>:
    Type: AWS::StorageGateway::NFSFileShare
    Properties:
      ClientToken: "<example_resource_id>"
      GatewayARN: "<example_resource_arn>"
      LocationARN: "<example_resource_arn>"
      Role: "<example_resource_arn>"
      KMSEncrypted: true  # Critical: enables KMS CMK encryption for the file share
      KMSKey: "<example_kms_key_arn>"  # Critical: CMK ARN used for encryption

Other

1In the AWS Console, go to Storage Gateway > File shares
2Select the affected file share and click Edit
3Under Encryption, choose AWS KMS key
4Select the CMK to use (or paste its ARN)
5Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.storagegateway.storagegateway_client import (
    storagegateway_client,
)


class storagegateway_fileshare_encryption_enabled(Check):
    def execute(self):
        findings = []
        for fileshare in storagegateway_client.fileshares:
            report = Check_Report_AWS(metadata=self.metadata(), resource=fileshare)
            report.status = "FAIL"
            report.status_extended = (
                f"StorageGateway File Share {fileshare.id} is not using KMS CMK."
            )
            if fileshare.kms:
                report.status = "PASS"
                report.status_extended = (
                    f"StorageGateway File Share {fileshare.id} is using KMS CMK."
                )

            findings.append(report)

        return findings

References