Description

Ensure that all Amazon RDS DB snapshots and DB cluster snapshots are encrypted at rest with an AWS KMS key. Snapshots contain a full copy of the database data, so they need the same protection as the database itself.

Rationale

An unencrypted snapshot gives direct access to the complete database contents if it is leaked, shared with another account or copied outside normal controls. Attackers can restore it and read the data offline, bypassing network and database access controls, and every database restored from it is also unencrypted. Encrypting all snapshots with KMS, preferably with customer managed keys and least-privilege key policies, keeps backups and their copies protected.

Impact

  • Protects database backups and their copies against unauthorized access

  • Databases restored from encrypted snapshots are also encrypted

  • An encrypted snapshot can only be shared with or restored by accounts that also have access to the KMS key

  • Encrypting existing snapshots requires creating encrypted copies, which uses additional storage until the unencrypted originals are deleted

Default Value

A snapshot is encrypted only if its source DB instance or DB cluster is encrypted. Encryption of an RDS DB instance or cluster can only be chosen when it is created, and an existing snapshot cannot be encrypted in place.

Pre-Requisites

  • IAM permissions: rds:DescribeDBSnapshots, rds:DescribeDBClusterSnapshots, rds:CopyDBSnapshot, rds:DeleteDBSnapshot, rds:RestoreDBClusterFromSnapshot, rds:CreateDBClusterSnapshot and rds:DeleteDBClusterSnapshot

  • KMS permissions on the chosen key: kms:DescribeKey and kms:CreateGrant

  • A KMS key in the same region as the snapshot (the AWS managed key aws/rds or a customer managed key)

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon RDS console and select Snapshots in the left menu.

  3. Review the Manual, System (automated) and DB cluster snapshot lists and check the encryption status of each snapshot in its details.

  4. Repeat for each region in use.

  5. If any snapshot is not encrypted, follow the implementation steps.

CLI:

List DB instance snapshots and their encryption status:

aws rds describe-db-snapshots --region <REGION> --query "DBSnapshots[].[DBSnapshotIdentifier,Engine,SnapshotType,Encrypted]" --output table

List DB cluster snapshots and their encryption status:

aws rds describe-db-cluster-snapshots --region <REGION> --query "DBClusterSnapshots[].[DBClusterSnapshotIdentifier,Engine,SnapshotType,StorageEncrypted]" --output table

A snapshot fails if Encrypted (DB snapshots) or StorageEncrypted (DB cluster snapshots) is False. Amazon DocumentDB snapshots are not evaluated.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon RDS console and select Snapshots in the left menu.

  3. For an unencrypted DB instance snapshot:

    • select the snapshot and choose Actions, then Copy snapshot,

    • enter a name for the new snapshot,

    • select Enable encryption and choose a KMS key,

    • choose Copy snapshot and wait until the copy is Available.

  4. For an unencrypted DB cluster snapshot (Aurora or Multi-AZ DB cluster), a copy cannot add encryption. Instead:

    • select the snapshot and choose Actions, then Restore snapshot,

    • enable encryption and choose a KMS key, then restore the cluster,

    • take a snapshot of the new encrypted cluster and delete the temporary cluster when no longer needed.

  5. After verifying the encrypted copy, select the original unencrypted manual snapshot and choose Actions, then Delete snapshot.

  6. Automated snapshots of an unencrypted DB instance or cluster stay unencrypted and expire with the backup retention period. To stop new unencrypted snapshots, migrate the database to an encrypted DB instance or cluster restored from an encrypted snapshot.

  7. Repeat for each unencrypted snapshot in each region in use.

CLI:

Create an encrypted copy of a DB instance snapshot:

aws rds copy-db-snapshot --region <REGION> --source-db-snapshot-identifier <SNAPSHOT_ID> --target-db-snapshot-identifier <SNAPSHOT_ID>-encrypted --kms-key-id <KMS_KEY_ID>

Check that the copy is available and encrypted:

aws rds describe-db-snapshots --region <REGION> --db-snapshot-identifier <SNAPSHOT_ID>-encrypted --query "DBSnapshots[].[DBSnapshotIdentifier,Status,Encrypted,KmsKeyId]" --output table

Delete the original unencrypted manual snapshot after the copy is verified:

aws rds delete-db-snapshot --region <REGION> --db-snapshot-identifier <SNAPSHOT_ID>

Backout Plan

  1. Do not delete the original unencrypted snapshot until the encrypted copy has been verified, for example by restoring it to a test instance.

  2. If the encrypted copy is not wanted, open the Amazon RDS console, select Snapshots, select the encrypted copy and choose Actions, then Delete snapshot.

CLI:

aws rds delete-db-snapshot --region <REGION> --db-snapshot-identifier <SNAPSHOT_ID>-encrypted

Note: a deleted snapshot cannot be recovered, and an encrypted snapshot cannot be converted back to unencrypted. Keeping unencrypted snapshots leaves the database data exposed if they are leaked or shared.

Reference