Neptune DB cluster snapshot is encrypted at rest

Check ID: neptune_cluster_snapshot_encrypted
Provider: AWS
Service: neptune
Severity: MEDIUM
Categories: encryption
Resource type: AwsRdsDbClusterSnapshot

What this check verifies

Neptune DB cluster snapshot is encrypted at rest. The evaluation looks at whether each snapshot’s encrypted attribute is enabled, confirming that the data is protected while stored.

Risk

Unencrypted Neptune snapshots undermine data confidentiality. If accessed or shared due to compromised credentials or misconfiguration, attackers can restore or download snapshot contents, enabling data exfiltration, and exposure of sensitive records. This weakens overall data protection posture.

Recommendation

Protect snapshot data by enforcing encryption at rest and strong key governance.

Use customer-managed keys with controlled lifecycle and rotation
Apply least privilege to snapshot access and sharing
Prevent creation of unencrypted snapshots via organizational configuration and policy controls

Remediation

CLI
Terraform
Dashboard steps

aws rds copy-db-cluster-snapshot —source-db-cluster-snapshot-identifier <source-snapshot> —target-db-cluster-snapshot-identifier <encrypted-snapshot> —kms-key-id <kms-key-id>

resource "aws_neptune_cluster" "restored" {
  cluster_identifier  = "restored-cluster"
  snapshot_identifier = "<source-snapshot>"
  storage_encrypted   = true  # Ensure restored cluster from snapshot is encrypted
}

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = neptune_cluster_snapshot_encrypted. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

NeptuneDB cluster snapshot is not publicly shared Neptune cluster storage is encrypted at rest

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires