RDS DB instances should have encryption at-rest enabled

Verifies that RDS DB instances have storage encryption enabled, which also covers their logs, automated backups, read replicas and snapshots. For an instance in a DB cluster the cluster owns the encryption, so the fix is the cluster's (RDS.27).

service: RDS
severity: Medium
scope: evaluated in every region

How to fix it

In the console

RDS → Snapshots → Copy snapshot with Encryption enabled, then Restore snapshot into a new DB instance

With Terraform

resource "aws_db_instance" "this" {
  instance_class    = var.instance_class
  storage_encrypted = true
  kms_key_id        = var.kms_key_arn
}

See which of your accounts this check is failing on.

Book a demo

RDS DB instances should have encryption at-rest enabled

How to fix it

In the console

With Terraform

More RDS checks