Other Articles

RDS DB Instance – Encryption of Storage

This check ensures that encryption is enabled for Amazon RDS DB instance storage. Encrypting RDS storage protects sensitive data at rest and helps meet security and compliance requirements.

Check Details

  • Resource: RDS DB Instance
  • Check: Enable encryption of RDS instance storage
  • Risk: Unencrypted database storage may expose sensitive data

Remediation via AWS Console

  1. Log in to the AWS Management Console and open the Amazon RDS console. Amazon RDS Console
  2. In the left navigation panel, click Databases and select the affected RDS DB instance.
  3. Choose Actions → Take snapshot. Provide a snapshot name and create the snapshot. Amazon RDS Console
  4. Once the snapshot is available, open the Snapshots section, select the snapshot, and choose Actions → Copy snapshot.
  5. Enable Encryption and select a KMS key. Encrypt RDS snapshot
  6. Select the encrypted snapshot and choose Restore snapshot. Restore snapshot
  7. Create a new RDS DB instance from the encrypted snapshot.
  8. Update application connections to point to the new encrypted DB instance.

Remediation via AWS CLI

  1. Log in to the AWS Management Console and click the CloudShell icon (>_) in the top-right corner. AWS CloudShell
  2. Create a snapshot of the unencrypted DB instance: 
    

aws rds create-db-snapshot \
 --db-instance-identifier <db-instance-id> \
 --db-snapshot-identifier <snapshot-id>
  3. Copy and encrypt the snapshot: 
    

aws rds copy-db-snapshot \
 --source-db-snapshot-identifier <snapshot-arn> \
 --target-db-snapshot-identifier <encrypted-snapshot-id> \
 --kms-key-id <kms-key-id>
  4. Restore a new encrypted DB instance from the snapshot: 
    

aws rds restore-db-instance-from-db-snapshot \
 --db-instance-identifier <new-db-instance-id> \
 --db-snapshot-identifier <encrypted-snapshot-id>

After restoration, update the application configuration to use the new encrypted RDS DB instance endpoint.