Neptune DB Clusters Storage Encryption Should Be Enabled

More Info:

This rule checks if storage encryption is enabled for your Amazon Neptune DB clusters. The rule is NON_COMPLIANT if storage encryption is not enabled.

Risk Level

Medium

Address

Security

Compliance Standards

SOC2,NIST,GDPR,ISO27001,HIPAA,HITRUST,NISTCSF,PCIDSS,SEBI

Triage and Remediation

Remediation

Using Console

Using CLI

To remediate the misconfiguration of Neptune DB Clusters storage encryption not being enabled in AWS RDS using AWS CLI, follow these steps:

Enable Encryption at Rest for Neptune DB Cluster:
- Run the following AWS CLI command to enable storage encryption for the Neptune DB cluster:
  aws neptune modify-db-cluster --db-cluster-identifier YOUR_DB_CLUSTER_IDENTIFIER --storage-encrypted
  Replace YOUR_DB_CLUSTER_IDENTIFIER with the actual identifier of your Neptune DB cluster.
Verify Encryption Status:
- You can verify that encryption at rest is enabled for the Neptune DB cluster by describing the cluster:
  aws neptune describe-db-clusters --db-cluster-identifier YOUR_DB_CLUSTER_IDENTIFIER --query 'DBClusters[*].StorageEncrypted'
  Ensure that the output shows "StorageEncrypted": true.
Update IAM Policies (if needed):
- If the AWS Identity and Access Management (IAM) policies need to be updated to reflect the changes in encryption settings, make sure to update them accordingly.
Monitor Encryption Status:
- Regularly monitor the encryption status of your Neptune DB cluster to ensure that encryption at rest remains enabled.

By following these steps, you can successfully remediate the misconfiguration of Neptune DB Clusters storage encryption not being enabled in AWS RDS using AWS CLI.

Using Python

To remediate the misconfiguration of Neptune DB Clusters Storage Encryption not being enabled in AWS RDS using Python, you can follow these steps:

Import the necessary libraries:

import boto3

Initialize the AWS RDS client:

client = boto3.client('rds')

Get a list of all Neptune DB clusters:

response = client.describe_db_clusters()

Iterate through each Neptune DB cluster and enable storage encryption if it is not already enabled:

for cluster in response['DBClusters']:
    cluster_identifier = cluster['DBClusterIdentifier']
    storage_encrypted = cluster['StorageEncrypted']
    
    if not storage_encrypted:
        try:
            client.modify_db_cluster(
                DBClusterIdentifier=cluster_identifier,
                StorageEncrypted=True
            )
            print(f"Storage encryption enabled for {cluster_identifier}")
        except Exception as e:
            print(f"Error enabling storage encryption for {cluster_identifier}: {str(e)}")

Save the Python script and run it in your AWS environment with appropriate IAM permissions to modify RDS clusters.

After running this script, it will enable storage encryption for all Neptune DB clusters that do not already have it enabled.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Neptune DB Clusters Storage Encryption Should Be Enabled

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation