---
title: "Ensure DocumentDB is encrypted at rest"
canonical: "https://kb.cynergy.app/space/MD/991789562/Ensure%20DocumentDB%20is%20encrypted%20at%20rest"
format: markdown
---
Cynergy Policy ID: CYN_AWS_GENERAL_28  
Severity: MEDIUM

#   
DocumentDB is not encrypted at rest

# Description

The encryption feature available for Amazon DocumentDB clusters provides an additional layer of data protection by helping secure your data against unauthorized access to the underlying storage.

Amazon DocumentDB allows you to encrypt your clusters using keys managed through the AWS Key Management Service (KMS). On a cluster running with Amazon DocumentDB encryption, data stored at rest in the underlying storage is encrypted, as are its automated backups, snapshots, and replicas in the same cluster.

# Fix - Runtime

## Procedure

1. Create an Amazon DocumentDB cluster.
2. Under the **Authentication** section, choose **Show Advanced Settings**.
3. Scroll down to the Encryption-at-rest section.
4. Choose the option that you want for encryption at rest. Whichever option you choose, you can't change it after the cluster is created.

To encrypt data at rest in this cluster, choose **Enable encryption**.

## CLI Command

Go

```go
aws docdb create-db-cluster \
      --db-cluster-identifier sample-cluster \
      --port 27017 \
      --engine docdb \
      --master-username yourMasterUsername \
      --master-user-password yourMasterPassword \
      --storage-encrypted

```

# Fix - Build time

## Terraform

- **Resource: **aws_docdb_cluster
- **Arguments: **storage_encrypted - Specifies whether the DB cluster is encrypted.

Go

```go
resource "aws_docdb_cluster" "example" {
  ...
  cluster_identifier = "docdb-cluster-demo"
+ storage_encrypted  = true
  ...
}
```