> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Neptune cluster encrypted remediation ### Triage and Remediation ### Remediation To remediate the misconfiguration of Neptune DB Clusters Storage Encryption not being enabled in AWS RDS, you can follow these step-by-step instructions using the AWS Management Console: 1. **Login to AWS Console**: Go to the AWS Management Console ([https://aws.amazon.com/](https://aws.amazon.com/)) and login to your account. 2. **Navigate to Amazon Neptune**: In the AWS Management Console, navigate to the Amazon Neptune service by either searching for it in the search bar or locating it under the "Database" category. 3. **Select the Neptune DB Cluster**: From the list of Neptune DB clusters, select the DB cluster for which you want to enable storage encryption. 4. **Enable Encryption**: In the Neptune DB cluster details page, click on the "Configuration" tab. 5. **Modify Cluster**: Under the "Cluster details" section, click on the "Modify" button to change the configuration settings. 6. **Enable Encryption at Rest**: Scroll down to the "Storage" section, and look for the "Storage encryption" option. Check the box next to "Enable storage encryption" to enable encryption at rest for your Neptune DB cluster. 7. **Choose Encryption Key**: If you have an existing AWS Key Management Service (KMS) key that you want to use for encryption, you can select it from the dropdown list. Otherwise, you can choose to create a new KMS key. 8. **Save Changes**: After enabling storage encryption and selecting the encryption key, scroll to the bottom of the page and click on the "Modify cluster" button to apply the changes. 9. **Monitor Progress**: The modification process may take some time to complete. You can monitor the progress in the "Modifications" tab of the Neptune DB cluster details page. 10. **Verification**: Once the modification is completed, verify that storage encryption is enabled for your Neptune DB cluster by checking the "Cluster details" section in the Neptune console. By following these steps, you can successfully remediate the misconfiguration of Neptune DB Clusters Storage Encryption not being enabled in AWS RDS using the AWS Management Console. # To remediate the misconfiguration of Neptune DB Clusters storage encryption not being enabled in AWS RDS using AWS CLI, follow these steps: 1. **Enable Encryption at Rest for Neptune DB Cluster**: * Run the following AWS CLI command to enable storage encryption for the Neptune DB cluster: ```bash theme={null} aws neptune modify-db-cluster --db-cluster-identifier YOUR_DB_CLUSTER_IDENTIFIER --storage-encrypted ``` Replace `YOUR_DB_CLUSTER_IDENTIFIER` with the actual identifier of your Neptune DB cluster. 2. **Verify Encryption Status**: * You can verify that encryption at rest is enabled for the Neptune DB cluster by describing the cluster: ```bash theme={null} aws neptune describe-db-clusters --db-cluster-identifier YOUR_DB_CLUSTER_IDENTIFIER --query 'DBClusters[*].StorageEncrypted' ``` Ensure that the output shows `"StorageEncrypted": true`. 3. **Update IAM Policies** (if needed): * If the AWS Identity and Access Management (IAM) policies need to be updated to reflect the changes in encryption settings, make sure to update them accordingly. 4. **Monitor Encryption Status**: * Regularly monitor the encryption status of your Neptune DB cluster to ensure that encryption at rest remains enabled. By following these steps, you can successfully remediate the misconfiguration of Neptune DB Clusters storage encryption not being enabled in AWS RDS using AWS CLI. To remediate the misconfiguration of Neptune DB Clusters Storage Encryption not being enabled in AWS RDS using Python, you can follow these steps: 1. Import the necessary libraries: ```python theme={null} import boto3 ``` 2. Initialize the AWS RDS client: ```python theme={null} client = boto3.client('rds') ``` 3. Get a list of all Neptune DB clusters: ```python theme={null} response = client.describe_db_clusters() ``` 4. Iterate through each Neptune DB cluster and enable storage encryption if it is not already enabled: ```python theme={null} for cluster in response['DBClusters']: cluster_identifier = cluster['DBClusterIdentifier'] storage_encrypted = cluster['StorageEncrypted'] if not storage_encrypted: try: client.modify_db_cluster( DBClusterIdentifier=cluster_identifier, StorageEncrypted=True ) print(f"Storage encryption enabled for {cluster_identifier}") except Exception as e: print(f"Error enabling storage encryption for {cluster_identifier}: {str(e)}") ``` 5. Save the Python script and run it in your AWS environment with appropriate IAM permissions to modify RDS clusters. After running this script, it will enable storage encryption for all Neptune DB clusters that do not already have it enabled. ```hcl theme={null} # New encrypted Neptune cluster restored from an encrypted snapshot # Substitute PLACEHOLDERS with your actual values. resource "aws_neptune_cluster" "encrypted" { cluster_identifier = "ENCRYPTED_CLUSTER_IDENTIFIER" # e.g. "my-neptune-cluster-encrypted" # Restore from the encrypted snapshot created via the CLI steps: # - aws neptune create-db-cluster-snapshot # - aws neptune copy-db-cluster-snapshot (with KMS) snapshot_identifier = "ENCRYPTED_SNAPSHOT_IDENTIFIER" # e.g. "my-neptune-cluster-encrypted-snapshot" engine = "neptune" # Match original cluster networking and auth settings db_subnet_group_name = "EXISTING_DB_SUBNET_GROUP_NAME" vpc_security_group_ids = ["EXISTING_SG_ID_1", "EXISTING_SG_ID_2"] iam_auth_enabled = true # or false, to match original # Encryption enabled using the appropriate KMS key storage_encrypted = true kms_key_arn = "KMS_KEY_ARN_OR_ALIAS" # e.g. "arn:aws:kms:REGION:ACCOUNT_ID:key/KEY_ID" or "alias/aws/rds" # Other settings to match the original cluster backup_retention_period = 7 preferred_backup_window = "03:00-04:00" preferred_maintenance_window = "sun:04:00-sun:05:00" # If you are still managing the old unencrypted cluster in Terraform, # give that resource a different name and, once migrated, remove it # from configuration so Terraform will delete it. } ``` This change creates a **new** encrypted Neptune cluster from the encrypted snapshot; it does not encrypt an existing cluster in place, so it forces replacement and a new endpoint, exactly like the CLI procedure. You must update application connection strings to the new endpoint and then remove the old unencrypted `aws_neptune_cluster` resource from Terraform so it is destroyed. For verification, `terraform plan` should show a new `aws_neptune_cluster.encrypted` being created with `storage_encrypted = true` and the old unencrypted cluster resource scheduled for destruction once you remove it from configuration.