RDS DB instance snapshot or DB cluster snapshot is encrypted

Check ID: rds_snapshots_encrypted
Provider: AWS
Service: rds
Severity: HIGH
Categories: encryption
Resource type: AwsRdsDbSnapshot

What this check verifies

RDS DB snapshots and DB cluster snapshots are evaluated for encryption at rest, identifying snapshots created with a KMS key versus unencrypted ones.

Risk

Unencrypted snapshots enable direct access to full database data if backups are leaked, cross-account shared, or stolen. Adversaries can harvest data offline, bypassing network controls, leading to loss of confidentiality. Restores from such snapshots propagate the exposure to new instances.

Recommendation

Encrypt all RDS snapshots at rest using KMS, preferably customer-managed keys. Apply least privilege to key usage, enforce encryption via templates and automation, and prevent sharing of unencrypted backups. Use key rotation, separation of duties, and ensure copies and cross-account shares remain encrypted.

Remediation

CLI
Terraform
Dashboard steps

aws rds copy-db-snapshot —source-db-snapshot-identifier <example_resource_id> —target-db-snapshot-identifier <example_resource_id>-encrypted —kms-key-id <KMS_KEY_ID>

resource "aws_db_snapshot_copy" "<example_resource_name>" {
  source_db_snapshot_identifier = "<example_resource_id>"
  target_db_snapshot_identifier = "<example_resource_id>-encrypted"
  kms_key_id                    = "<KMS_KEY_ID>" # Critical: encrypts the copied snapshot using the specified KMS key
}

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = rds_snapshots_encrypted. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

RDS instance enforces SSL/TLS for client connections RDS snapshot is not publicly shared

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires