RDS DB instance snapshot or DB cluster snapshot is encrypted
rds_snapshots_encrypted
RDS DB snapshots and DB cluster snapshots are evaluated for encryption at rest, identifying snapshots created with a KMS key versus unencrypted ones.
Risk
Unencrypted snapshots enable direct access to full database data if backups are leaked, cross-account shared, or stolen. Adversaries can harvest data offline, bypassing network controls, leading to loss of confidentiality. Restores from such snapshots propagate the exposure to new instances.
prowler aws --checks rds_snapshots_encrypted
Recommendation
Encrypt all RDS snapshots at rest using KMS, preferably customer-managed keys. Apply least privilege to key usage, enforce encryption via templates and automation, and prevent sharing of unencrypted backups. Use key rotation, separation of duties, and ensure copies and cross-account shares remain encrypted.
Remediation
aws rds copy-db-snapshot --source-db-snapshot-identifier <example_resource_id> --target-db-snapshot-identifier <example_resource_id>-encrypted --kms-key-id <KMS_KEY_ID>
- In the AWS Console, go to RDS > Snapshots
- Select the unencrypted snapshot (for clusters, use the DB cluster snapshots tab)
- Click Actions > Copy snapshot
- Check Enable encryption and choose a KMS key
- Click Copy snapshot and wait for completion
- After verifying the new encrypted snapshot, delete the original unencrypted snapshot (Actions > Delete snapshot)
Source Code
Resource Type
AwsRdsDbSnapshot