Homepage

RDS instance is not using encrypted storage Affecting RDS service in AWS

Severity

0.0
medium
0
10
Severity Framework
Snyk CCSS
Rule category
Data/ Encryption at Rest

Is your environment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
Frameworks
AWS-Well-ArchitectedCIS-AWSCIS-ControlsCSA-CCMGDPRHIPAAISO-27001NIST-800-53SOC-2
  • Snyk IDSNYK-CC-00002
  • creditSnyk Research Team
Report a new misconfiguration Found a mistake?

Description

Encrypting your DB instance data at rest provides an extra layer of protection against unauthorized access. You can supply your own customer managed KMS key to use for encryption, or RDS can use an AWS managed key which is created automatically. RDS instances can only be encrypted at the time of creation.

How to fix?

Set the aws_db_instance storage_encrypted field to true.

If encrypting with a customer managed KMS key, kms_key_id should be set to the KMS key ARN.

The storage_encrypted setting can only be enabled at the time the instance is created. If you have an existing instance that is not encrypted, you will need to recreate it from scratch or from an encrypted copy of an instance snapshot.

Example configuration:

resource "aws_db_instance" "default" {
  storage_encrypted = true
  # other required fields here
}