AWS > Rds > Enable Performance Insights Encryption
HIGH
Source
Trivy
ID
AVD-AWS-0078

Encryption for RDS Performance Insights should be enabled.

When enabling Performance Insights on an RDS cluster or RDS DB Instance, and encryption key should be provided.

The encryption key specified in performance_insights_kms_key_id references a KMS ARN

Impact

Data can be read from the RDS Performance Insights if it is compromised

Follow the appropriate remediation steps below to resolve the issue.

Enable encryption for RDS clusters and instances

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
---
AWSTemplateFormatVersion: "2010-09-09"
Description: A sample template
AWSTemplateFormatVersion: 2010-09-09
Description: Good example
Resources:
  Queue:
    Type: AWS::RDS::DBInstance
    Properties:
      EnablePerformanceInsights: true
      PerformanceInsightsKMSKeyId: "something"

Enable encryption for RDS clusters and instances

1
2
3
4
5
resource "aws_rds_cluster_instance" "good_example" {
  name = "bar"
  performance_insights_enabled = true
  performance_insights_kms_key_id = "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
}