> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Neptune cluster snapshot encrypted remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration of Neptune Cluster snapshots not being encrypted in AWS RDS using the AWS Management Console, follow these steps:

        1. **Sign in to the AWS Management Console**: Go to [https://aws.amazon.com/](https://aws.amazon.com/) and sign in to the AWS Management Console using your credentials.

        2. **Navigate to Amazon Neptune Console**: Once logged in, navigate to the Amazon Neptune console by typing "Neptune" in the search bar at the top of the console and selecting "Amazon Neptune" from the dropdown.

        3. **Select your Neptune Cluster**: In the Amazon Neptune console, select the Neptune cluster for which you want to enable encryption for snapshots.

        4. **Enable Encryption for Snapshots**:
           * Click on the Neptune cluster name to view its details.
           * In the left-hand navigation pane, click on "Snapshots".
           * Select the snapshot for which you want to enable encryption.
           * Click on the "Actions" dropdown menu and select "Modify Snapshot".
           * In the "Modify Snapshot" window, enable the option for "Encrypt snapshot" and select the appropriate KMS key for encryption.
           * Click on "Modify snapshot" to save the changes.

        5. **Verify Encryption**:
           * Once the modification is complete, verify that the snapshot is now encrypted by checking the "Encrypted" column in the list of snapshots.

        By following these steps, you have successfully remediated the misconfiguration of Neptune Cluster snapshots not being encrypted in AWS RDS using the AWS Management Console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration of Neptune clusters snapshots not being encrypted in AWS RDS using AWS CLI, you can follow these steps:

        1. **List all existing Neptune clusters in your AWS account**:
           Run the following AWS CLI command to list all existing Neptune clusters:
           ```
           aws neptune describe-db-clusters
           ```

        2. **Enable encryption for Neptune cluster snapshots**:
           For each Neptune cluster that you identified in the previous step, you need to enable encryption for its snapshots. Run the following AWS CLI command for each cluster:

           ```
           aws neptune modify-db-cluster --db-cluster-identifier <cluster-identifier> --storage-encrypted
           ```

           Replace `<cluster-identifier>` with the actual identifier of the Neptune cluster you want to enable encryption for.

        3. **Verify encryption status**:
           To verify that encryption has been enabled for the Neptune cluster snapshots, you can describe the cluster again and check the `StorageEncrypted` attribute. Run the following AWS CLI command:

           ```
           aws neptune describe-db-clusters --db-cluster-identifier <cluster-identifier>
           ```

           Replace `<cluster-identifier>` with the identifier of the Neptune cluster you modified.

        4. **Repeat for all Neptune clusters**:
           Repeat steps 2 and 3 for each Neptune cluster in your AWS account to ensure that encryption is enabled for all cluster snapshots.

        By following these steps, you can remediate the misconfiguration of Neptune clusters snapshots not being encrypted in AWS RDS using AWS CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration of Neptune Cluster snapshots not being encrypted in AWS, you can follow these steps using Python and AWS SDK (boto3):

        1. Install the AWS SDK (boto3) if you haven't already:

        ```bash theme={null}
        pip install boto3
        ```

        2. Write a Python script to enable encryption for Neptune Cluster snapshots:

        ```python theme={null}
        import boto3

        def encrypt_neptune_snapshots():
            # Initialize the Neptune client
            client = boto3.client('neptune')

            # Get a list of all Neptune clusters
            clusters = client.describe_db_clusters()

            for cluster in clusters['DBClusters']:
                # Get the ARN of the cluster
                cluster_arn = cluster['DBClusterArn']
                
                # Enable encryption for snapshots of the cluster
                response = client.modify_db_cluster(
                    DBClusterIdentifier=cluster_arn,
                    BackupRetentionPeriod=7,  # Set the retention period for snapshots
                    StorageEncrypted=True  # Enable encryption for snapshots
                )

                print(f"Encryption enabled for Neptune cluster snapshots: {cluster_arn}")

        if __name__ == '__main__':
            encrypt_neptune_snapshots()
        ```

        3. Run the Python script to enable encryption for Neptune Cluster snapshots:

        ```bash theme={null}
        python encrypt_neptune_snapshots.py
        ```

        This script will iterate through all Neptune clusters in your AWS account and enable encryption for their snapshots. Make sure to have the necessary IAM permissions to modify Neptune clusters.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # There is currently no Terraform resource in the AWS provider that performs
        # the `copy-db-cluster-snapshot` operation for Neptune (or RDS) with a new KMS key,
        # so this specific remediation cannot be expressed in Terraform.

        # To remediate, you must use the AWS CLI or Console, exactly as in the verified fix:
        # 1) Create an encrypted copy of the unencrypted DB cluster snapshot with your KMS key:
        #    aws neptune copy-db-cluster-snapshot \
        #      --source-db-cluster-snapshot-identifier UNENCRYPTED_SNAPSHOT_ID \
        #      --target-db-cluster-snapshot-identifier ENCRYPTED_SNAPSHOT_ID \
        #      --kms-key-id YOUR_KMS_KEY_ID
        #
        # 2) After you have verified the new encrypted snapshot is created and usable,
        #    delete the original unencrypted snapshot:
        #    aws neptune delete-db-cluster-snapshot \
        #      --db-cluster-snapshot-identifier UNENCRYPTED_SNAPSHOT_ID
        #
        # WARNING: Deleting the original snapshot is irreversible. Do NOT delete it until
        # you have confirmed the new encrypted snapshot is valid.

        # Since no Terraform changes can implement this copy/delete sequence, `terraform plan`
        # will show no changes related to this remediation.
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>