---
title: "Ensure all data stored in Aurora is securely encrypted at rest"
canonical: "https://kb.cynergy.app/space/MD/991593034/Ensure%20all%20data%20stored%20in%20Aurora%20is%20securely%20encrypted%20at%20rest"
format: markdown
---
Cynergy Policy ID: CYN_AWS_GENERAL_38  
Severity: HIGH

# Not all data stored in Aurora is securely encrypted at rest

# Description

This policy examines the resource **aws_rds_cluster** to check that encryption is set up. The property **storage_encrypted** is examined.

# Fix - Runtime

## AWS Console

TBA

## CLI Command

# Fix - Build time

## Terraform

- **Resource:** aws_rds_cluster
- **Argument:** storage_encrypted

aws_rds_cluster.test.tf

```shell
resource "aws_rds_cluster" "example" {
  ...
  cluster_identifier      = "aurora-cluster-demo"
+ storage_encrypted       = true
  ...
}

```

## CloudFormation

- **Resource:** AWS::RDS::DBCluster
- **Argument:** Properties.StorageEncrypted

YAML

```yaml
Resources:
  Aurora:
    Type: 'AWS::RDS::DBCluster'
    Properties:
      ...
      Engine: 'aurora'
+     StorageEncrypted: true
			...

```