Description

Ensure that Amazon RDS clusters (including Aurora clusters) have storage encryption enabled using an AWS KMS key, so that the underlying database storage, automated backups, snapshots, and read replicas are all encrypted at rest.

Rationale

Without storage encryption, database data is stored unencrypted on the underlying storage, and any snapshots, automated backups, or read replicas derived from the cluster are similarly unencrypted, which does not meet common confidentiality requirements for data stored in a relational database. Enabling storage encryption at cluster creation time ensures this data, and everything derived from it, is protected at rest using AWS KMS.

Impact

  • Protects database storage, backups, snapshots, and replicas at rest

  • Supports compliance requirements mandating encryption of data at rest

  • Storage encryption can only be enabled at cluster creation time and cannot be changed on an existing, unencrypted cluster

Default Value

Storage encryption is disabled by default for a newly created RDS cluster unless explicitly enabled at creation time.

Pre-Requisites

  • An AWS KMS key, if a customer-managed key is required (otherwise the AWS-managed default RDS key can be used)

  • IAM permissions to view and create RDS clusters and snapshots (rds:DescribeDBClusters, rds:CreateDBCluster, rds:CopyDBClusterSnapshot)

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon RDS > Databases and select the cluster to review.

  3. Open the Configuration tab.

  4. Review the Storage encrypted field.

  5. Verify that it shows as Enabled.

  6. If storage encryption is disabled, follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon RDS > Databases and select the unencrypted cluster.

  3. Create a manual snapshot of the cluster.

  4. Select the snapshot and choose Copy snapshot, enabling Enable encryption and selecting the desired KMS key during the copy operation (this produces an encrypted copy of the snapshot).

  5. Restore a new RDS cluster from the encrypted snapshot copy.

  6. Update application connection configuration to point to the new, encrypted cluster's endpoint, verify functionality, and decommission the original unencrypted cluster once the migration is verified.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon RDS > Snapshots, select a snapshot of the encrypted cluster, and restore it to a new, unencrypted cluster (note that an encrypted snapshot cannot be restored as unencrypted; a manual export/import of data would be required to fully revert).

  3. Update application connection configuration and decommission the encrypted cluster once the migration is verified.

Reference