Skip to main content

๐Ÿ›ก๏ธ AWS RDS Snapshot is not encrypted๐ŸŸข

Logicโ€‹

Similar Policiesโ€‹

Descriptionโ€‹

Open File

Descriptionโ€‹

This policy identifies AWS RDS cluster and database Snapshots that are not encrypted.

Rationaleโ€‹

RDS snapshots contain full backups of databases, including potentially sensitive data. If an unencrypted snapshot is inadvertently shared or if its underlying storage is compromised, the data may be exposed to unauthorized access. Enforcing encryption helps ensure that backup data remains protected, maintaining the confidentiality and integrity of stored information.

Auditโ€‹

This policy marks an AWS RDS Snapshot as INCOMPLIANT if the snapshot's Encrypted checkbox is set to false.

The Snapshot is marked as INAPPLICABLE if its Status is not available.

Remediationโ€‹

Open File

Remediationโ€‹

Encrypt a Snapshotโ€‹

To encrypt an unencrypted AWS RDS snapshot, create an encrypted copy of the existing snapshot using a KMS key, then remove the original unencrypted version.

From Command Lineโ€‹

  1. Create an encrypted copy of the snapshot:

    aws rds copy-db-snapshot \
        --source-db-snapshot-identifier {{source-snapshot-id}} \
        --target-db-snapshot-identifier {{new-snapshot-id}} \
        --kms-key-id {{kms-key-id}} \
        --copy-option-group \
        --copy-tags \
        --region {{region}}

  2. Delete the original unencrypted snapshot (optional):

    Once you have confirmed that the encrypted snapshot is available, delete the original unencrypted snapshot.

    aws rds delete-db-snapshot \
        --db-snapshot-identifier {{source-snapshot-id}} \
        --region {{region}}

policy.yamlโ€‹

Open File

Linked Framework Sectionsโ€‹

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
๐Ÿ’ผ AWS Foundational Security Best Practices v1.0.0 โ†’ ๐Ÿ’ผ [Neptune.6] Neptune DB cluster snapshots should be encrypted at rest1no data
๐Ÿ’ผ AWS Foundational Security Best Practices v1.0.0 โ†’ ๐Ÿ’ผ [RDS.4] RDS cluster snapshots and database snapshots should be encrypted at rest1no data
๐Ÿ’ผ AWS Well-Architected โ†’ ๐Ÿ’ผ SEC08-BP02 Enforce encryption at rest14no data
๐Ÿ’ผ Cloudaware Framework โ†’ ๐Ÿ’ผ Data Encryption54no data
๐Ÿ’ผ FedRAMP High Security Controls โ†’ ๐Ÿ’ผ CM-3(6) Cryptography Management (H)12no data
๐Ÿ’ผ FedRAMP High Security Controls โ†’ ๐Ÿ’ผ SC-7(10) Prevent Exfiltration (H)12no data
๐Ÿ’ผ FedRAMP High Security Controls โ†’ ๐Ÿ’ผ SC-7(18) Fail Secure (M)(H)1no data
๐Ÿ’ผ FedRAMP High Security Controls โ†’ ๐Ÿ’ผ SC-13 Cryptographic Protection (L)(M)(H)1632no data
๐Ÿ’ผ FedRAMP High Security Controls โ†’ ๐Ÿ’ผ SC-28 Protection of Information at Rest (L)(M)(H)1731no data
๐Ÿ’ผ FedRAMP High Security Controls โ†’ ๐Ÿ’ผ SC-28(1) Cryptographic Protection (L)(M)(H)520no data
๐Ÿ’ผ FedRAMP Low Security Controls โ†’ ๐Ÿ’ผ SC-13 Cryptographic Protection (L)(M)(H)32no data
๐Ÿ’ผ FedRAMP Low Security Controls โ†’ ๐Ÿ’ผ SC-28 Protection of Information at Rest (L)(M)(H)131no data
๐Ÿ’ผ FedRAMP Low Security Controls โ†’ ๐Ÿ’ผ SC-28(1) Cryptographic Protection (L)(M)(H)20no data
๐Ÿ’ผ FedRAMP Moderate Security Controls โ†’ ๐Ÿ’ผ SC-7(18) Fail Secure (M)(H)1no data
๐Ÿ’ผ FedRAMP Moderate Security Controls โ†’ ๐Ÿ’ผ SC-13 Cryptographic Protection (L)(M)(H)32no data
๐Ÿ’ผ FedRAMP Moderate Security Controls โ†’ ๐Ÿ’ผ SC-28 Protection of Information at Rest (L)(M)(H)131no data
๐Ÿ’ผ FedRAMP Moderate Security Controls โ†’ ๐Ÿ’ผ SC-28(1) Cryptographic Protection (L)(M)(H)20no data
๐Ÿ’ผ NIST CSF v2.0 โ†’ ๐Ÿ’ผ PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected159no data
๐Ÿ’ผ NIST CSF v2.0 โ†’ ๐Ÿ’ผ PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected135no data
๐Ÿ’ผ NIST CSF v2.0 โ†’ ๐Ÿ’ผ PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected151no data
๐Ÿ’ผ NIST SP 800-53 Revision 5 โ†’ ๐Ÿ’ผ CA-9(1) Internal System Connections _ Compliance Checks31no data
๐Ÿ’ผ NIST SP 800-53 Revision 5 โ†’ ๐Ÿ’ผ CM-3(6) Configuration Change Control _ Cryptography Management12no data
๐Ÿ’ผ NIST SP 800-53 Revision 5 โ†’ ๐Ÿ’ผ SC-7(10) Boundary Protection _ Prevent Exfiltration12no data
๐Ÿ’ผ NIST SP 800-53 Revision 5 โ†’ ๐Ÿ’ผ SC-7(18) Boundary Protection _ Fail Secure1no data
๐Ÿ’ผ NIST SP 800-53 Revision 5 โ†’ ๐Ÿ’ผ SC-13 Cryptographic Protection421no data
๐Ÿ’ผ NIST SP 800-53 Revision 5 โ†’ ๐Ÿ’ผ SC-28 Protection of Information at Rest31732no data
๐Ÿ’ผ NIST SP 800-53 Revision 5 โ†’ ๐Ÿ’ผ SC-28(1) Protection of Information at Rest _ Cryptographic Protection1020no data
๐Ÿ’ผ NIST SP 800-53 Revision 5 โ†’ ๐Ÿ’ผ SI-7(6) Software, Firmware, and Information Integrity _ Cryptographic Protection19no data