AWS RDS DB cluster encryption is disabled
Description
AWS RDS is a managed DB service enabling quick deployment and management of MySQL, MariaDB, PostgreSQL, Oracle, and Microsoft SQL Server DB engines. Native RDS encryption helps protect your cloud applications and fulfils compliance requirements for data-at-rest encryption.
Code Example
{
"aws rds create-db-instance \\
--db-instance-identifier test-mysql-instance \\
--db-instance-class db.t3.micro \\
--engine mysql \\
--master-username admin \\
--master-user-password secret99 \\
--allocated-storage 20
--storage-encrypted true
",
}Remediation
- AWS Console*
To change the policy using the AWS Console, follow these steps:
. Log in to the AWS Management Console at https://console.aws.amazon.com/.
. Open the * https://console.aws.amazon.com/rds/[Amazon RDS console]*.
. Click * Snapshots*.
. Select the snapshot that you want to encrypt.
. Navigate to * Snapshot Actions*, select * Copy Snapshot*.
. Select the * Destination Region*, then enter your * New DB Snapshot Identifier*.
. Set * Enable Encryption* to * Yes*.
. Select the * Master Key* from the list, then select * Copy Snapshot*.
- CLI Command*
If you use the create-db-instance AWS CLI command to create an encrypted DB instance, set the --storage-encrypted parameter to true. If you use the CreateDBInstance API operation, set the StorageEncrypted parameter to true.
Rule Details
| Field | Value |
|---|---|
| ID | IAC-0070 |
| Severity | LOW |
| IaC Type | Cloudformation |
| Frameworks | CloudFormation, Terraform, TerraformPlan, Serverless |
| Checkov ID | CKV_AWS_16 |