All checks
Medium
RDS DB clusters should be encrypted at rest
Verifies that RDS DB clusters are encrypted at rest, which also covers the cluster's automated backups, logs and snapshots. DocumentDB and Neptune clusters are evaluated too; for those, the routes are aws_docdb_cluster or aws_neptune_cluster and the docdb or neptune form of restore-db-cluster-from-snapshot.
- service
- RDS
- severity
- Medium
- scope
- evaluated in every region
How to fix it
In the console
RDS → Snapshots → Restore snapshot, with Encryption set on the new DB cluster (Amazon DocumentDB or Neptune console for those engines)
With the AWS CLI
aws rds restore-db-cluster-from-snapshot --db-cluster-identifier <new-db-cluster-identifier> --snapshot-identifier <db-cluster-snapshot-identifier> --engine <engine> --kms-key-id <kms-key-id> --region <region>With Terraform
resource "aws_rds_cluster" "this" {
engine = var.engine
storage_encrypted = true
kms_key_id = var.kms_key_arn
}See which of your accounts this check is failing on.
Book a demo