Encrypt Instance Storage Data | Vulnerability Database

RDS encryption has not been enabled at a DB Instance level.

Encryption should be enabled for an RDS Database instances.

When enabling encryption by setting the kms_key_id.

Impact

Data can be read from RDS instances if compromised

Recommended Actions

Follow the appropriate remediation steps below to resolve the issue.

Enable encryption for RDS instances

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


AWSTemplateFormatVersion: 2010-09-09
Description: Good example of rds sgr
Resources:
  Instance:
    Type: AWS::RDS::DBInstance
    Properties:
      StorageEncrypted: true
      KmsKeyId: "something"

Log in to the AWS Management Console.
Select the “Services” option and search for RDS.
Scroll down the left navigation panel and choose “Databases”.
Select the “Database” that needs to be verified and click on the selected “Database” from the “DB identifier” column to access the database.
Click on the “Configuration” under the selected database configuration page.
Scroll down the “Configuration” tab and check the “Storage” section.Check the “Encryption” and if it’s “Not Enabled” then encryption is not setup for selected RDS instance.
Select the “Database” on which “Encryption” needs to be enabled.
Click on the “Actions” button at the top panel and click on “Take snapshot”.
On “Take DB snapshot” page provide a “Snapshot name” which will act as an identifier for the “DB Snapshot” and click on “Take Snapshot” button.
Select the new created “Snapshot” and click on the “Actions” button at the top menu and click on the “Copy Snapshot” option.
Under the “Copy snapshot” configuration page select the “Destination Region” and provide the “New DB Snapshot Identifier” for the new snapshot.
Scroll down the “Copy snapshot” configuration page and click on “Enable encryption” under Encryption section. Select the “AWS KMS Key” from dropdown menu and click on the “Copy Snapshot” button.
Select the new created “Snapshot” and click on the “Actions” button at the top menu and click on the “Restore Snapshot” option.
On “Restore snapshot” configuration page review all the configuration settings and provide a unique name to the “DB Instance Identifier” under “Settings”.
Scroll down and click on the “Restore DB Instance” button.
Update the “Database Endpoint” as soon as the new instance provisioning process is completed and the database instance is available.
Remove the unencrypted database instance by selecting the database and clicking on the “Actions” button at the top menu and clicking on the “Delete” button under “Delete” panel.
Repeat step 7 to 17 for all other RDS databases.

Enable encryption for RDS instances

1
2
3
4


 resource "aws_db_instance" "good_example" {
 	storage_encrypted  = true
 }
 

Remediation Links

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance