---
title: "Ensure AWS RDS DB cluster encryption is enabled"
canonical: "https://kb.cynergy.app/space/MD/991854919/Ensure%20AWS%20RDS%20DB%20cluster%20encryption%20is%20enabled"
format: markdown
---
Cynergy Policy ID: CYN_AWS_GENERAL_4  
Severity: HIGH

#   
AWS RDS DB cluster encryption is disabled

# Description

AWS RDS is a managed DB service enabling quick deployment and management of MySQL, MariaDB, PostgreSQL, Oracle, and Microsoft SQL Server DB engines. Native RDS encryption helps protect your cloud applications and fulfills compliance requirements for data-at-rest encryption.

# Fix - Runtime

## AWS Console

To change the policy using the AWS Console, follow these steps:

1. Log in to the AWS Management Console at <u>[https://console.aws.amazon.com/](https://console.aws.amazon.com/)</u>.
2. Open the <u>**[Amazon RDS console](https://console.aws.amazon.com/rds/)**</u>.
3. Click **Snapshots**.
4. Select the snapshot that you want to encrypt.
5. Navigate to **Snapshot Actions**, and select **Copy Snapshot**.
6. Select the **Destination Region**, then enter your **New DB Snapshot Identifier**.
7. Set **Enable Encryption** to **Yes**.
8. Select the **Master Key** from the list, then select **Copy Snapshot**.

## CLI Command

If you use the create-db-instance AWS CLI command to create an encrypted DB instance, set the --storage-encrypted parameter to true. If you use the CreateDBInstance API operation, set the StorageEncrypted parameter to true.

Shell

```shell
aws rds create-db-instance \
    --db-instance-identifier test-mysql-instance \
    --db-instance-class db.t3.micro \
    --engine mysql \
    --master-username admin \
    --master-user-password secret99 \
    --allocated-storage 20
    --storage-encrypted true

```

# Fix - Build time

## Terraform

- **Resource**: aws_db_instance
- **Argument**: storage_encrypted - Specifies whether the DB instance is encrypted.

aws_db_instance

```shell
resource "aws_db_instance" "example" {
  ...
  name                 = "mydb"
+ storage_encrypted    = true 
}

```

## CloudFormation

- **Resource**: AWS::RDS::DBInstance
- **Argument**: Properties.StorageEncrypted

YAML

```yaml
Resources:
  DB:
    Type: 'AWS::RDS::DBInstance'
    Properties:
      ...
+     StorageEncrypted: true

```