All checks
Medium
RDS cluster snapshots and database snapshots should be encrypted at rest
Verifies that RDS DB snapshots and DB cluster snapshots are encrypted at rest, so the data in them stays protected wherever they are copied or restored. The Terraform and CLI routes copy a DB snapshot; a cluster snapshot takes the cluster form of the same copy operation.
- service
- RDS
- severity
- Medium
- scope
- evaluated in every region
How to fix it
In the console
RDS → Snapshots → Copy snapshot → Encryption
With the AWS CLI
aws rds copy-db-snapshot --source-db-snapshot-identifier <source-db-snapshot-identifier> --target-db-snapshot-identifier <target-db-snapshot-identifier> --kms-key-id <kms-key-id> --region <region>With Terraform
resource "aws_db_snapshot_copy" "encrypted" {
source_db_snapshot_identifier = var.source_snapshot_arn
target_db_snapshot_identifier = var.target_snapshot_id
kms_key_id = var.kms_key_arn
}See which of your accounts this check is failing on.
Book a demo