# Ensure to have backup protection - encryption of backup for RDS

- Source: https://support.icompaas.com/support/solutions/articles/62000229663-ensure-to-have-backup-protection-encryption-of-backup-for-rds
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [General](https://support.icompaas.com/support/solutions/62000037933) › [Policy Updates](https://support.icompaas.com/support/solutions/folders/62000168784)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description:**

This policy ensures that all Amazon Relational Database Service (RDS) backups are encrypted. This helps to protect sensitive data from being exposed in the event of a data breach.

**Rationale:**

Encrypting RDS backups helps to protect sensitive data from being exposed in the event of a data breach. If backups are not encrypted, they could be accessed by unauthorized individuals.

**Impact:**

If backups are not encrypted, sensitive data could be exposed, which could lead to identity theft, financial loss, or other negative consequences.

**Default Value:**

AWS recommends that you encrypt all RDS backups. However, it is up to you to decide whether or not to encrypt your backups.

**Pre-requisites:**

-   You must have access to the AWS console.
-   You must have the AWS CLI installed and configured.

**Remediation Steps:**

1.  Log in to the AWS console.
2.  Select the RDS instance that you want to modify.
3.  Click the **Backups** tab.
4.  Click the **Encryption** tab.
5.  Select the **Enable encryption** checkbox.
6.  Select the encryption method that you want to use.
7.  Click the **Save** button.

**Test Plan:**

1.  Verify that the RDS backups are encrypted.
2.  Verify that you can restore the RDS backups from the encrypted backup files.

**Implementation Plan:**

1.  Create a new AWS IAM policy that allows users to encrypt RDS backups.
2.  Attach the new policy to the IAM users who need to be able to encrypt RDS backups.
3.  Verify that the IAM users who need to be able to encrypt RDS backups can actually do so.

**AWS CLI Process:**

```
aws rds modify-db-instance --db-instance-identifier my-db-instance --enable-encryption
```

**Using AWS GUI:**

1.  Log in to the AWS console.
2.  Select the RDS console.
3.  Select the RDS instance that you want to modify.
4.  Click the **Backups** tab.
5.  Click the **Encryption** tab.
6.  Select the **Enable encryption** checkbox.
7.  Select the encryption method that you want to use.
8.  Click the **Save** button.

**Backout Plan:**

1.  Disable encryption for the RDS backups.
2.  Delete the AWS IAM policy that allows users to encrypt RDS backups.

**Note:**

-   You can also use the AWS CLI to enable encryption for RDS backups.
-   For more information, see the AWS RDS documentation: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html.

**Reference:**

-   AWS RDS documentation: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html

**Tags and Keywords:**

-   backup
-   encryption
-   rds
-   security
-   compliance

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.