> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Docdb cluster encrypted remediation ### Triage and Remediation ### Remediation To remediate the misconfiguration of DocumentDB clusters not being encrypted in AWS RDS using the AWS Management Console, you can follow these step-by-step instructions: 1. **Login to AWS Console**: Go to the AWS Management Console ([https://aws.amazon.com/console/](https://aws.amazon.com/console/)) and log in to your AWS account. 2. **Navigate to Amazon DocumentDB**: In the AWS Management Console, navigate to the Amazon DocumentDB service by either searching for "DocumentDB" in the search bar or locating it under the "Database" section. 3. **Select the DocumentDB Cluster**: From the DocumentDB dashboard, select the DocumentDB cluster that you want to encrypt. 4. **Enable Encryption**: Click on the selected DocumentDB cluster, and then click on the "Modify" button to make changes to the cluster configuration. 5. **Enable Encryption at Rest**: In the cluster configuration settings, scroll down to the "Encryption" section. Here, you will find an option to enable encryption at rest. Select the option to enable encryption. 6. **Choose the Encryption Key**: Choose the AWS Key Management Service (KMS) key that you want to use for encrypting the DocumentDB cluster. You can either use the default AWS-managed key or choose a custom KMS key. 7. **Save Changes**: After selecting the encryption key, scroll down to the bottom of the configuration page and click on the "Apply immediately" checkbox if you want the changes to take effect immediately. Then click on the "Modify cluster" button to save the changes. 8. **Monitor Encryption Status**: Once the modification is initiated, monitor the status of the encryption process in the DocumentDB cluster dashboard. The encryption process may take some time to complete depending on the size of the cluster. 9. **Verification**: After the encryption process is completed, verify that the DocumentDB cluster is now encrypted by checking the cluster details and ensuring that the encryption status is showing as "Encrypted". By following these steps, you can successfully remediate the misconfiguration of DocumentDB clusters not being encrypted in AWS RDS using the AWS Management Console. # To remediate the misconfiguration of DocumentDB clusters not being encrypted in AWS RDS using AWS CLI, follow these steps: Step 1: Enable encryption for the DocumentDB cluster using the AWS CLI command below: ```bash theme={null} aws rds modify-db-cluster --db-cluster-identifier your-cluster-id --storage-encrypted ``` Replace `your-cluster-id` with the actual identifier of your DocumentDB cluster. Step 2: Verify the encryption status of the DocumentDB cluster to ensure that it is now encrypted. You can do this by describing the cluster using the following AWS CLI command: ```bash theme={null} aws rds describe-db-clusters --db-cluster-identifier your-cluster-id --query "DBClusters[*].StorageEncrypted" ``` Step 3: Once you have confirmed that the encryption is enabled for the DocumentDB cluster, ensure that all future DocumentDB clusters are also encrypted by default. You can do this by modifying the RDS cluster parameter group as follows: ```bash theme={null} aws rds modify-db-cluster-parameter-group --db-cluster-parameter-group-name your-parameter-group-name --parameters "ParameterName=aws_docdb_encryption_support,ParameterValue=true,ApplyMethod=immediate" ``` Replace `your-parameter-group-name` with the actual name of your RDS cluster parameter group. By following these steps, you can successfully remediate the misconfiguration of DocumentDB clusters not being encrypted in AWS RDS using the AWS CLI. To remediate the misconfiguration of DocumentDB clusters not being encrypted in AWS RDS using Python, you can follow these steps: 1. Install the AWS SDK for Python (Boto3) if you haven't already. You can install it using pip: ```bash theme={null} pip install boto3 ``` 2. Write a Python script to enable encryption for your DocumentDB clusters. Here's an example script that uses Boto3 to enable encryption for all DocumentDB clusters in your AWS account: ```python theme={null} import boto3 # Initialize the DocumentDB client client = boto3.client('docdb') # Get a list of all DocumentDB clusters response = client.describe_db_clusters() # Iterate through each cluster and enable encryption for cluster in response['DBClusters']: cluster_identifier = cluster['DBClusterIdentifier'] # Enable encryption for the cluster client.modify_db_cluster( DBClusterIdentifier=cluster_identifier, StorageEncrypted=True ) print(f"Encryption enabled for DocumentDB cluster: {cluster_identifier}") ``` 3. Run the Python script in your local environment or AWS Lambda function with appropriate IAM permissions to modify DocumentDB clusters. 4. Monitor the script output to ensure that encryption is enabled for all DocumentDB clusters. You can also verify this in the AWS Management Console by checking the encryption status of each cluster. By following these steps, you can remediate the misconfiguration of DocumentDB clusters not being encrypted in AWS RDS using Python. ```hcl theme={null} # Existing (unencrypted) cluster – REMOVE this resource from Terraform # once the new encrypted cluster is live so Terraform will destroy it. # resource "aws_docdb_cluster" "EXISTING_CLUSTER" { # cluster_identifier = "EXISTING_CLUSTER_ID" # replace with current cluster ID # engine = "docdb" # # storage_encrypted is either false or unset here # # other existing arguments... # } # 1) Snapshot of the existing unencrypted cluster resource "aws_docdb_cluster_snapshot" "EXISTING_CLUSTER_SNAPSHOT_FOR_ENCRYPTION" { db_cluster_snapshot_identifier = "EXISTING_CLUSTER_ID-snapshot-for-encryption" # substitute EXISTING_CLUSTER_ID db_cluster_identifier = "EXISTING_CLUSTER_ID" # substitute EXISTING_CLUSTER_ID } # 2) New, encrypted cluster restored from the snapshot resource "aws_docdb_cluster" "ENCRYPTED_CLUSTER" { cluster_identifier = "EXISTING_CLUSTER_ID-encrypted" # new cluster ID engine = "docdb" # Restore from the snapshot of the old cluster snapshot_identifier = aws_docdb_cluster_snapshot.EXISTING_CLUSTER_SNAPSHOT_FOR_ENCRYPTION.db_cluster_snapshot_identifier # Required to match the original cluster’s networking setup db_subnet_group_name = "DB_SUBNET_GROUP_FROM_ORIGINAL_CLUSTER" # substitute vpc_security_group_ids = ["SG_ID_FROM_ORIGINAL_CLUSTER"] # substitute one or more SG IDs # Enable storage encryption at creation time storage_encrypted = true # Optional but recommended: specify KMS key # kms_key_id = "KMS_KEY_ARN_OR_ID" # substitute if needed # add any other required settings from the original cluster configuration } # WARNING: Changing from unencrypted to encrypted requires replacing the cluster. # This is disruptive and results in a new cluster with a new endpoint; all # applications must be pointed at aws_docdb_cluster.ENCRYPTED_CLUSTER.endpoint # before removing the old cluster resource so Terraform can delete it. # Deletion of the original cluster is irreversible; keep a final snapshot if needed. ``` `terraform plan` should show the new `aws_docdb_cluster_snapshot` being created and a new `aws_docdb_cluster` with `storage_encrypted = true` being created, and (once you remove the old cluster resource from the configuration) the original unencrypted cluster being destroyed.