Rule: RDS DB Snapshots Should Be Encrypted at Rest

Rule Description

Troubleshooting Steps

2. 1.
   Check RDS Encryption: Verify if encryption is enabled for the RDS instance.
4. 2.
   Verify Snapshot Encryption: Confirm if the DB snapshots are encrypted.
6. 3.
   Review IAM Policies: Ensure the necessary IAM policies are in place for snapshot encryption.
8. 4.
   Check KMS Configuration: Validate the Key Management Service (KMS) configuration for RDS encryption.

Necessary Codes

Step-by-Step Guide for Remediation

2. 1.

   Log in to the AWS Management Console or open the AWS CLI.

4. 2.

   Identify the RDS DB instance for which you want to enable snapshot encryption.

6. 3.

   Verify RDS Encryption:

   • In the AWS Management Console, navigate to the RDS service.
   • Select the appropriate region.
   • Click on "Databases" in the left sidebar.
   • Choose the desired RDS instance from the list.
   • In the "Connectivity & security" section, verify that "Encryption" is enabled.
8. 4.

   Create a New Encrypted Snapshot:

   • Select the RDS instance that you want to create an encrypted snapshot for.
   • Click on "Actions" and choose "Take snapshot."
   • In the snapshot creation wizard, provide a name and description for the snapshot.
   • Tick the checkbox for "Enable encryption" to encrypt the new snapshot.
   • Configure any other desired snapshot settings and click on "Create snapshot."
10. 5.

    Verify Snapshot Encryption:

    • After the snapshot is created, navigate to the AWS RDS service page.
    • Choose the appropriate region.
    • Click on "Snapshots" in the left sidebar.
    • Find the newly created snapshot and verify that the "Encrypted" column shows "Yes."
12. 6.

    Review IAM Policies:

    • Ensure that the user or role performing the snapshot creation has the necessary IAM policies assigned to them.
    • IAM policies should include the

      rds:CopyDBSnapshot

      and

      rds:CreateDBSnapshot

      actions.
14. 7.

    Check KMS Configuration:

    • Confirm that the Key Management Service (KMS) is properly configured for RDS encryption.
    • Navigate to the AWS Management Console and open the KMS service.
    • Select the same region where the RDS instance resides.
    • Ensure that the encryption key utilized for RDS encryption is correctly configured.