# Ensure RDS snapshots are encrypted - Source: https://support.icompaas.com/support/solutions/articles/a_1793292228371435-ensure-rds-snapshots-are-encrypted - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224) - Last updated: 2026-10-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Description** Ensure that all Amazon RDS DB snapshots and DB cluster snapshots are encrypted at rest with an AWS KMS key. Snapshots contain a full copy of the database data, so they need the same protection as the database itself. **Rationale** An unencrypted snapshot gives direct access to the complete database contents if it is leaked, shared with another account or copied outside normal controls. Attackers can restore it and read the data offline, bypassing network and database access controls, and every database restored from it is also unencrypted. Encrypting all snapshots with KMS, preferably with customer managed keys and least-privilege key policies, keeps backups and their copies protected. **Impact** - Protects database backups and their copies against unauthorized access - Databases restored from encrypted snapshots are also encrypted - An encrypted snapshot can only be shared with or restored by accounts that also have access to the KMS key - Encrypting existing snapshots requires creating encrypted copies, which uses additional storage until the unencrypted originals are deleted **Default Value** A snapshot is encrypted only if its source DB instance or DB cluster is encrypted. Encryption of an RDS DB instance or cluster can only be chosen when it is created, and an existing snapshot cannot be encrypted in place. **Pre-Requisites** - IAM permissions: rds:DescribeDBSnapshots, rds:DescribeDBClusterSnapshots, rds:CopyDBSnapshot, rds:DeleteDBSnapshot, rds:RestoreDBClusterFromSnapshot, rds:CreateDBClusterSnapshot and rds:DeleteDBClusterSnapshot - KMS permissions on the chosen key: kms:DescribeKey and kms:CreateGrant - A KMS key in the same region as the snapshot (the AWS managed key aws/rds or a customer managed key) **Remediation** **Test Plan** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon RDS console and select **Snapshots** in the left menu. 3. Review the **Manual**, **System** (automated) and DB cluster snapshot lists and check the encryption status of each snapshot in its details. 4. Repeat for each region in use. 5. If any snapshot is not encrypted, follow the implementation steps. **CLI:** List DB instance snapshots and their encryption status: aws rds describe-db-snapshots --region --query "DBSnapshots\[\].\[DBSnapshotIdentifier,Engine,SnapshotType,Encrypted\]" --output table List DB cluster snapshots and their encryption status: aws rds describe-db-cluster-snapshots --region --query "DBClusterSnapshots\[\].\[DBClusterSnapshotIdentifier,Engine,SnapshotType,StorageEncrypted\]" --output table A snapshot fails if Encrypted (DB snapshots) or StorageEncrypted (DB cluster snapshots) is False. Amazon DocumentDB snapshots are not evaluated. **Implementation Steps** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon RDS console and select **Snapshots** in the left menu. 3. For an unencrypted DB instance snapshot: - select the snapshot and choose **Actions**, then **Copy snapshot**, - enter a name for the new snapshot, - select **Enable encryption** and choose a KMS key, - choose **Copy snapshot** and wait until the copy is **Available**. 4. For an unencrypted DB cluster snapshot (Aurora or Multi-AZ DB cluster), a copy cannot add encryption. Instead: - select the snapshot and choose **Actions**, then **Restore snapshot**, - enable encryption and choose a KMS key, then restore the cluster, - take a snapshot of the new encrypted cluster and delete the temporary cluster when no longer needed. 5. After verifying the encrypted copy, select the original unencrypted manual snapshot and choose **Actions**, then **Delete snapshot**. 6. Automated snapshots of an unencrypted DB instance or cluster stay unencrypted and expire with the backup retention period. To stop new unencrypted snapshots, migrate the database to an encrypted DB instance or cluster restored from an encrypted snapshot. 7. Repeat for each unencrypted snapshot in each region in use. **CLI:** Create an encrypted copy of a DB instance snapshot: aws rds copy-db-snapshot --region --source-db-snapshot-identifier --target-db-snapshot-identifier -encrypted --kms-key-id Check that the copy is available and encrypted: aws rds describe-db-snapshots --region --db-snapshot-identifier -encrypted --query "DBSnapshots\[\].\[DBSnapshotIdentifier,Status,Encrypted,KmsKeyId\]" --output table Delete the original unencrypted manual snapshot after the copy is verified: aws rds delete-db-snapshot --region --db-snapshot-identifier **Backout Plan** 1. Do not delete the original unencrypted snapshot until the encrypted copy has been verified, for example by restoring it to a test instance. 2. If the encrypted copy is not wanted, open the Amazon RDS console, select **Snapshots**, select the encrypted copy and choose **Actions**, then **Delete snapshot**. **CLI:** aws rds delete-db-snapshot --region --db-snapshot-identifier -encrypted Note: a deleted snapshot cannot be recovered, and an encrypted snapshot cannot be converted back to unencrypted. Keeping unencrypted snapshots leaves the database data exposed if they are leaked or shared. **Reference** - [https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html) - [https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER\_CopySnapshot.html](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_CopySnapshot.html) - [https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-4](https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-4) - [https://docs.aws.amazon.com/cli/latest/reference/rds/copy-db-snapshot.html](https://docs.aws.amazon.com/cli/latest/reference/rds/copy-db-snapshot.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.