Check ID: rds_instance_storage_encrypted
Provider: AWS
Service: rds
Severity: HIGH
Categories: encryption
Resource type: AwsRdsDbInstance

​
What this check verifies

RDS DB instances are assessed for KMS-based encryption at rest (StorageEncrypted=true), covering instance storage and derived artifacts such as snapshots, automated backups, and read replicas.

​
Risk

Without encryption at rest, database files, snapshots, and automated backups remain in plaintext. An attacker with access to copied snapshots, compromised backups, or underlying storage can read sensitive data, causing loss of confidentiality and enabling large-scale exfiltration.

​
Recommendation

Enable encryption at rest for all RDS instances. Prefer customer-managed KMS keys to control rotation and fine-grained access, applying least privilege and defense in depth. Restrict key usage, monitor key activity, and manage key lifecycle. Migrate unencrypted instances via encrypted snapshot copy and restore.

​
Remediation

# Terraform: create an encrypted RDS DB instance
resource "aws_db_instance" "<example_resource_name>" {
  engine            = "<engine>"
  instance_class    = "<instance_class>"
  username          = "<username>"
  password          = "<password>"
  allocated_storage = 20

  storage_encrypted = true  # CRITICAL: enables encryption at rest to pass the check
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = rds_instance_storage_encrypted. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks