RDS DB instances are assessed for KMS-based encryption at rest (StorageEncrypted=true), covering instance storage and derived artifacts such as snapshots, automated backups, and read replicas.
Risk
Without encryption at rest, database files, snapshots, and automated backups remain in plaintext. An attacker with access to copied snapshots, compromised backups, or underlying storage can read sensitive data, causing loss of confidentiality and enabling large-scale exfiltration.
prowler aws --checks rds_instance_storage_encrypted
Recommendation
Enable encryption at rest for all RDS instances. Prefer customer-managed KMS keys to control rotation and fine-grained access, applying least privilege and defense in depth. Restrict key usage, monitor key activity, and manage key lifecycle. Migrate unencrypted instances via encrypted snapshot copy and restore.
Remediation
- In the AWS Console, go to RDS > Databases, select the unencrypted DB instance, then choose Actions > Take snapshot.
- After the snapshot is available, go to Snapshots, select it, choose Actions > Copy snapshot, enable encryption, and select a KMS key (or aws/rds).
- When the encrypted copy is ready, select it and choose Actions > Restore snapshot to create a new (encrypted) DB instance.
- Update your application/endpoint to use the new encrypted DB instance.
- Decommission the old unencrypted instance after cutover.
Source Code
Resource Type
AwsRdsDbInstance
References
- https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/aws/RDS/rds-encryption-enabled.html
- https://aws.amazon.com/blogs/storage/protecting-amazon-rds-db-instances-encrypted-using-kms-aws-managed-key-with-cross-account-and-cross-region-backups/
- https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html