Vulnerabilities
Misconfiguration
Compliance
AWS > Rds >

Encrypt Cluster Storage Data

HIGH
Source
Trivy
ID
AVD-AWS-0079
cloudformation terraform

There is no encryption specified or encryption is disabled on the RDS Cluster.

Encryption should be enabled for an RDS Aurora cluster. When enabling encryption by setting the kms_key_id, the storage_encrypted must also be set to true.

Impact

Follow the appropriate remediation steps below to resolve the issue.

Enable encryption for RDS clusters

1
2
3
4
5
6

Resources:
  GoodExample:
    Type: AWS::RDS::DBCluster
    Properties:
      KmsKeyId: something
      StorageEncrypted: true

Enable encryption for RDS clusters

1
2
3
4
5

resource "aws_rds_cluster" "good_example" {
  name              = "bar"
  kms_key_id        = "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
  storage_encrypted = true
}
Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2025 Aqua Security Software Ltd.   Privacy Policy | Terms of Use