Check ID: neptune_cluster_storage_encrypted
Provider: AWS
Service: neptune
Severity: HIGH
Categories: encryption
Resource type: Other

​
What this check verifies

Neptune DB cluster is evaluated for encryption at rest. Indicating the cluster’s underlying storage is not encrypted.

​
Risk

Unencrypted Neptune storage reduces confidentiality of stored data and metadata and increases attack surface. Possible impacts:
  • Unauthorized access or data exfiltration from underlying volumes or snapshots
  • Greater blast radius from leaked or shared snapshots

​
Recommendation

Provision all new Neptune DB clusters with encryption at rest and prefer Customer-Managed Keys (CMK) for key ownership and auditability. Enforce least privilege on KMS keys, implement key lifecycle practices (rotation, revocation) and ensure backups/snapshots remain encrypted to prevent exposure.

​
Remediation

resource "aws_neptune_cluster" "example_resource" {
  cluster_identifier = "<cluster-id>"
  storage_encrypted  = true  # Enable encryption at rest for data protection
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = neptune_cluster_storage_encrypted. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks