Check ID: rds_cluster_storage_encrypted
Provider: AWS
Service: rds
Severity: HIGH
Categories: encryption
Resource type: AwsRdsDbCluster

​
What this check verifies

RDS DB clusters are assessed for encryption at rest via AWS KMS. It determines whether cluster storage-and related artifacts like automated backups and snapshots-are encrypted with a KMS key.

​
Risk

Unencrypted clusters expose data on disk, logs, and snapshots to unauthorized reading if storage or backups are obtained. This compromises confidentiality, enables offline exfiltration from leaked snapshots, and can widen blast radius during incidents and migrations.

​
Recommendation

Create clusters with StorageEncrypted=true using AWS KMS, preferably customer-managed keys. Apply least privilege to key usage, enable rotation and monitoring, and separate key administration from DB operations. Ensure snapshots and cross-account copies remain encrypted for defense in depth.

​
Remediation

# Terraform: Create an encrypted RDS/Aurora DB cluster
resource "aws_rds_cluster" "<example_resource_name>" {
  engine          = "<ENGINE>"
  master_username = "<MASTER_USERNAME>"
  master_password = "<MASTER_PASSWORD>"
  storage_encrypted = true  # Critical: enables encryption at rest for the cluster
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = rds_cluster_storage_encrypted. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks