Homepage

RDS cluster is not using encrypted storage Affecting RDS service in AWS

Severity

0.0
medium
0
10
Severity Framework
Snyk CCSS
Rule category
Data/ Encryption at Rest

Is your environment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
Frameworks
CIS-AWSCIS-ControlsCSA-CCM
  • Snyk IDSNYK-CC-00333
  • creditSnyk Research Team
Report a new misconfiguration Found a mistake?

Description

Encrypting your DB cluster data at rest provides an extra layer of protection against unauthorized access. You can supply your own customer managed KMS key to use for encryption, or RDS can use an AWS managed key which is created automatically. RDS clusters can only be encrypted at the time of creation.

How to fix?

Set the aws_rds_cluster storage_encrypted field to true.

If encrypting with a customer managed KMS key, kms_key_id should be set to the KMS key ARN.

The storage_encrypted setting can only be enabled at the time the cluster is created. If you have an existing cluster that is not encrypted, you will need to recreate it from scratch or from an encrypted copy of an RDS snapshot.

Example Configuration

resource "aws_rds_cluster" "default" {
  storage_encrypted = true
  # other required fields here
}