> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Rds encryption enabled remediation ### Triage and Remediation ### Remediation To remediate the misconfiguration of RDS instances not having encryption enabled in AWS, you can follow these steps using the AWS Management Console: 1. **Login to AWS Console**: Go to the AWS Management Console and login with your credentials. 2. **Navigate to RDS Dashboard**: Click on the "Services" dropdown menu at the top of the page and select "RDS" under the Database category. 3. **Create a Snapshot of the Unencrypted DB Instance** a. Select your DB instance. b. Click on Actions and choose Take snapshot. c. Provide a unique Snapshot Identifier and create the snapshot. d. Copy the Snapshot with Encryption 4. **Create Encrypted Snapshot from Unencrypted Snapshot** a. In the RDS Dashboard, go to Snapshots and select the snapshot you just created. b. Click on Actions and choose Copy snapshot. c. In the copy dialog, enable Encryption by selecting your desired AWS KMS key. d. Specify a new identifier for the encrypted snapshot and start the copy process. 5. **Restore a New Encrypted DB Instance from the Encrypted Snapshot** a. Once the encrypted snapshot is available, select it. b. Click on Actions and choose Restore snapshot. c. Provide a new DB instance identifier and adjust the instance settings as needed. d. Launch the new encrypted instance. By following these steps, you can remediate the misconfiguration of RDS instances without encryption enabled using AWS Console. Amazon RDS does not support enabling encryption on an existing unencrypted DB instance. However, you can achieve encryption by creating a new encrypted instance and migrating the data. Here are the steps for AWS CLI: 1. **Identify the RDS Instances without Encryption Enabled:** Run the following AWS CLI command to list all RDS instances without encryption enabled: ```bash theme={null} aws rds describe-db-instances --query "DBInstances[?StorageEncrypted==\`false\`].DBInstanceIdentifier" ``` 2. **Create a Snapshot:** For each RDS instance identified in the previous step, create a db snapshot using the following command: ```bash theme={null} aws rds create-db-snapshot \ --db-instance-identifier \ --db-snapshot-identifier ``` Replace `` with the identifier of the RDS instance that needs encryption enabled. 3. **Iterate through all the instances and perform below steps:** 4. **Copy the Snapshot with Encryption Enabled:** ```bash theme={null} aws rds copy-db-snapshot \ --source-db-snapshot-identifier \ --target-db-snapshot-identifier \ --kms-key-id ``` Replace `` with the RDS instance snapshot identifier created in the above step. 5. **Restore a New Encrypted DB Instance from the Encrypted Snapshot:** Once the encryption modification is complete, verify that encryption is enabled for the RDS instance by running: ```bash theme={null} aws rds restore-db-instance-from-db-snapshot \ --db-instance-identifier \ --db-snapshot-identifier ``` Replace `` with the Encrypted snapshot identifier created in the above step. 6. **(Optional) Delete Old Unencrypted Instances:** ```bash theme={null} for db in $(aws rds describe-db-instances --query "DBInstances[?StorageEncrypted==\`false\`].DBInstanceIdentifier" --output text); do aws rds delete-db-instance --db-instance-identifier $db --skip-final-snapshot echo "Deleted old unencrypted instance: $db" done ``` By following these steps, you can remediate the misconfiguration of RDS instances not having encryption enabled in AWS using AWS CLI. Amazon RDS does not support enabling encryption on an existing unencrypted DB instance. However, you can achieve encryption by creating a new encrypted instance and migrating the data. Here are the steps using Python: 1. **Import the necessary Python libraries:** ```python theme={null} import boto3 ``` 2. Initialize the AWS RDS client: ```python theme={null} client = boto3.client('rds') ``` 3. Get a list of all RDS instances: ```python theme={null} response = client.describe_db_instances() ``` 4. **Create a snapshot of the current unencrypted DB instance:** ```python theme={null} # Step 1: Create a snapshot snapshot_id = f"{db_instance}-unencrypted-snapshot" print(f"Creating snapshot: {snapshot_id}") rds_client.create_db_snapshot(DBInstanceIdentifier=db_instance, DBSnapshotIdentifier=snapshot_id) # Wait until snapshot is available waiter = rds_client.get_waiter('db_snapshot_available') waiter.wait(DBSnapshotIdentifier=snapshot_id) print(f"Snapshot {snapshot_id} is now available.") ``` 5. **Create new snapshot with Encryption:** ```python theme={null} # Step 2: Copy the snapshot with encryption encrypted_snapshot_id = f"{db_instance}-encrypted-snapshot" print(f"Copying snapshot with encryption: {encrypted_snapshot_id}") rds_client.copy_db_snapshot( SourceDBSnapshotIdentifier=snapshot_id, TargetDBSnapshotIdentifier=encrypted_snapshot_id, KmsKeyId=kms_key_id ) # Wait until encrypted snapshot is available waiter.wait(DBSnapshotIdentifier=encrypted_snapshot_id) print(f"Encrypted snapshot {encrypted_snapshot_id} is now available.") ``` 6. **Restore to create a new Encrypted database:** ```python theme={null} # Step 3: Restore a new encrypted DB instance new_db_instance = f"{db_instance}-encrypted" print(f"Restoring new encrypted DB instance: {new_db_instance}") rds_client.restore_db_instance_from_db_snapshot( DBInstanceIdentifier=new_db_instance, DBSnapshotIdentifier=encrypted_snapshot_id ) # Step 4: Wait for the new DB instance to be available db_waiter = rds_client.get_waiter('db_instance_available') db_waiter.wait(DBInstanceIdentifier=new_db_instance) print(f"New encrypted DB instance {new_db_instance} is now available.") ``` Make sure you have the necessary IAM permissions to describe and modify RDS instances. Also, ensure that you have the AWS SDK for Python (Boto3) installed. This script will iterate through all RDS instances in your AWS account, check if encryption is enabled, take a snapshot, create a new encrypted snapshot, and create new database using encrypted snapshot. ```hcl theme={null} resource "aws_db_instance" "THIS_DB" { # Replace with the identifier of the RDS instance identifier = "EXISTING_DB_IDENTIFIER" # ... all your existing required arguments ... engine = "ENGINE_NAME" # e.g. "mysql" engine_version = "ENGINE_VERSION" # e.g. "8.0.35" instance_class = "DB_INSTANCE_CLASS" # e.g. "db.m6g.large" allocated_storage = 20 username = "MASTER_USERNAME" password = "MASTER_PASSWORD" db_subnet_group_name = aws_db_subnet_group.DB_SUBNET_GROUP.name vpc_security_group_ids = [ aws_security_group.DB_SG.id, ] # Enable storage encryption at rest storage_encrypted = true # Optional: use a customer-managed KMS key instead of the default RDS key # kms_key_id = aws_kms_key.RDS_ENCRYPTION_KEY.arn # ... any other existing settings ... } ``` Enabling `storage_encrypted = true` on an RDS instance that was originally created unencrypted forces **replacement**: Terraform will destroy the existing instance and create a new, encrypted one. To avoid data loss, follow AWS guidance to create an encrypted snapshot from an unencrypted snapshot and restore it into a new encrypted instance, then import that into Terraform or adjust your state accordingly before applying. After updating Terraform, `terraform plan` should show the `aws_db_instance.THIS_DB` resource with `storage_encrypted` changing from `false` (or being added) to `true`, and it will be marked with `-/+` indicating it will be replaced.