DocumentDB cluster storage is encrypted at rest

Check ID: documentdb_cluster_storage_encrypted
Provider: AWS
Service: documentdb
Severity: MEDIUM
Categories: encryption
Resource type: AwsRdsDbCluster

What this check verifies

Amazon DocumentDB clusters are assessed for storage encryption at rest via the cluster’s encrypted setting. It identifies clusters where data volumes, automated backups, and snapshots aren’t protected by AWS KMS-managed encryption.

Risk

Without at-rest encryption, cluster data, snapshots, and backups can be read in plaintext if copies are leaked, mis-shared, or underlying storage is accessed. This harms confidentiality, enables offline analysis and data exfiltration, and widens the blast radius of insider or backup repository compromise.

Recommendation

Enable storage encryption at rest for all DocumentDB clusters and prefer customer-managed KMS keys for control over access, rotation, and revocation. Apply least privilege to key usage, enforce separation of duties, and monitor key and snapshot access. If a cluster isn’t encrypted, migrate to a new encrypted cluster.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws docdb create-db-cluster —db-cluster-identifier <DB_CLUSTER_ID> —engine docdb —master-username <MASTER_USERNAME> —master-user-password <MASTER_PASSWORD> —storage-encrypted

# Terraform: Encrypted DocumentDB cluster
resource "aws_docdb_cluster" "<example_resource_name>" {
  master_username   = "<MASTER_USERNAME>"
  master_password   = "<MASTER_PASSWORD>"
  storage_encrypted = true  # Critical: enables encryption at rest to pass the check
}

# CloudFormation: Create an encrypted DocumentDB cluster
Resources:
  <example_resource_name>:
    Type: AWS::DocDB::DBCluster
    Properties:
      Engine: docdb
      MasterUsername: <MASTER_USERNAME>
      MasterUserPassword: <MASTER_PASSWORD>
      StorageEncrypted: true  # Critical: enables encryption at rest to pass the check

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = documentdb_cluster_storage_encrypted. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

DocumentDB manual cluster snapshot is not shared publicly Elastic Disaster Recovery is enabled with a recovery job

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires