---
title: "Session Manager data is not encrypted in transit"
canonical: "https://kb.cynergy.app/space/MD/1209630722/Session%20Manager%20data%20is%20not%20encrypted%20in%20transit"
format: markdown
---
# Description

This policy flags AWS RDS database cluster snapshots that lack encryption, which is essential for securing production data containing sensitive information. Implementing encryption at rest protects these snapshots from unauthorized access.

# Fix - Build time

## Terraform

- **Resource**: aws_ssm_document
- **Argument**: kmsKeyId

```go aws_ssm_document.test.tf resource "aws_ssm_document" "enabled" { name = "SSM-SessionManagerRunShell" document_type = "Session"

content = <<DOC { ... "inputs": { ... "s3EncryptionEnabled": true, + "kmsKeyId": "${var.kms_key_id}", "runAsEnabled": false,  
... } } } DOC } ```