Description

Ensure that every Amazon RDS DB cluster, including Amazon Aurora and Multi-AZ DB clusters, has its storage encrypted at rest with an AWS KMS key. When a cluster is encrypted, its underlying storage, automated backups, snapshots and read replicas are encrypted as well. Amazon DocumentDB clusters are not covered by this check.

Rationale

If cluster storage is not encrypted, data on disk, in logs and in snapshots can be read by anyone who gains access to the storage or to a copied or shared snapshot. This weakens confidentiality and allows offline data theft from leaked backups. Clusters should be created with storage encryption enabled using AWS KMS, preferably with a customer managed key, with least-privilege access to the key and with snapshots and cross-account copies kept encrypted.

Impact

  • Protects cluster data, backups and snapshots at rest from unauthorized access

  • Encryption cannot be turned on for an existing cluster; a new encrypted cluster must be created and applications must be moved to it, which requires a maintenance window

  • Using a customer managed KMS key adds key management and KMS request costs

Default Value

Encryption at rest can only be chosen when a DB cluster is created. An existing unencrypted cluster cannot be changed to encrypted.

Pre-Requisites

  • IAM permissions: rds:DescribeDBClusters, rds:CreateDBClusterSnapshot, rds:RestoreDBClusterFromSnapshot, rds:CreateDBInstance and rds:DeleteDBCluster

  • If a customer managed key is used: kms:DescribeKey and kms:CreateGrant on that key

  • A maintenance window to switch applications to the new cluster endpoint

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon RDS console and select Databases.

  3. Select each database whose role is a cluster and open the Configuration tab.

  4. Check that Encryption is Enabled and note the KMS key in use.

  5. Repeat for each region in use.

  6. If any cluster is not encrypted, follow the implementation steps.

CLI:

List all DB clusters with their encryption setting and KMS key:

aws rds describe-db-clusters --region <REGION> --query "DBClusters[].[DBClusterIdentifier,Engine,StorageEncrypted,KmsKeyId]" --output table

A cluster fails if StorageEncrypted is False. Clusters with the docdb engine are not evaluated.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon RDS console and select Databases.

  3. Select the unencrypted DB cluster, choose Actions, then Take snapshot, and wait until the snapshot is available.

  4. Select Snapshots, select the new snapshot, then choose Actions and Restore snapshot.

  5. In the restore settings, enable encryption and select the KMS key to use (the AWS managed key aws/rds or a customer managed key).

  6. Enter the remaining settings to match the original cluster and choose Restore DB cluster.

  7. If the restore option does not allow encryption for this cluster type, create a new cluster with Enable encryption selected and migrate the data to it.

  8. Point applications to the new cluster endpoint and confirm they work.

  9. Delete the original unencrypted cluster once it is no longer needed.

  10. Repeat for each affected cluster in each region in use.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Keep the original unencrypted cluster (or its snapshot) until the new encrypted cluster has been fully validated.

  3. If problems occur, point applications back to the original cluster endpoint.

  4. Delete the new encrypted cluster if it is no longer needed.

Note: rolling back leaves the data unencrypted at rest. Use it only as a temporary measure.

Reference