Skip to main content

🛡️ AWS RDS Snapshot is not encrypted🟢

Logic​

Similar Policies​

Description​

Open File

Description​

This policy identifies AWS RDS cluster and database Snapshots that are not encrypted.

Rationale​

RDS snapshots contain full backups of databases, including potentially sensitive data. If an unencrypted snapshot is inadvertently shared or if its underlying storage is compromised, the data may be exposed to unauthorized access. Enforcing encryption helps ensure that backup data remains protected, maintaining the confidentiality and integrity of stored information.

Audit​

This policy marks an AWS RDS Snapshot as INCOMPLIANT if the snapshot's Encrypted checkbox is set to false.

The Snapshot is marked as INAPPLICABLE if its Status is not available.

Remediation​

Open File

Remediation​

Encrypt a Snapshot​

To encrypt an unencrypted AWS RDS snapshot, create an encrypted copy of the existing snapshot using a KMS key, then remove the original unencrypted version.

From Command Line​

  1. Create an encrypted copy of the snapshot:

    aws rds copy-db-snapshot \
        --source-db-snapshot-identifier {{source-snapshot-id}} \
        --target-db-snapshot-identifier {{new-snapshot-id}} \
        --kms-key-id {{kms-key-id}} \
        --copy-option-group \
        --copy-tags \
        --region {{region}}

  2. Delete the original unencrypted snapshot (optional):

    Once you have confirmed that the encrypted snapshot is available, delete the original unencrypted snapshot.

    aws rds delete-db-snapshot \
        --db-snapshot-identifier {{source-snapshot-id}} \
        --region {{region}}

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [Neptune.6] Neptune DB cluster snapshots should be encrypted at rest1no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [RDS.4] RDS cluster snapshots and database snapshots should be encrypted at rest1no data
💼 AWS Well-Architected → 💼 SEC08-BP02 Enforce encryption at rest19no data
💼 Cloudaware Framework → 💼 Data Encryption66no data
💼 FedRAMP High Security Controls → 💼 CM-3(6) Cryptography Management (H)16no data
💼 FedRAMP High Security Controls → 💼 SC-7(10) Prevent Exfiltration (H)16no data
💼 FedRAMP High Security Controls → 💼 SC-7(18) Fail Secure (M)(H)1no data
💼 FedRAMP High Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)1640no data
💼 FedRAMP High Security Controls → 💼 SC-28 Protection of Information at Rest (L)(M)(H)1735no data
💼 FedRAMP High Security Controls → 💼 SC-28(1) Cryptographic Protection (L)(M)(H)524no data
💼 FedRAMP Low Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)40no data
💼 FedRAMP Low Security Controls → 💼 SC-28 Protection of Information at Rest (L)(M)(H)135no data
💼 FedRAMP Low Security Controls → 💼 SC-28(1) Cryptographic Protection (L)(M)(H)24no data
💼 FedRAMP Moderate Security Controls → 💼 SC-7(18) Fail Secure (M)(H)1no data
💼 FedRAMP Moderate Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)40no data
💼 FedRAMP Moderate Security Controls → 💼 SC-28 Protection of Information at Rest (L)(M)(H)135no data
💼 FedRAMP Moderate Security Controls → 💼 SC-28(1) Cryptographic Protection (L)(M)(H)24no data
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected173no data
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected149no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected169no data
💼 NIST SP 800-53 Revision 5 → 💼 CA-9(1) Internal System Connections _ Compliance Checks39no data
💼 NIST SP 800-53 Revision 5 → 💼 CM-3(6) Configuration Change Control _ Cryptography Management16no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(10) Boundary Protection _ Prevent Exfiltration16no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(18) Boundary Protection _ Fail Secure1no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-13 Cryptographic Protection429no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-28 Protection of Information at Rest31736no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-28(1) Protection of Information at Rest _ Cryptographic Protection1024no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-7(6) Software, Firmware, and Information Integrity _ Cryptographic Protection25no data