> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Snapshot Encryption Feature Should Be Enabled ### More Info: Your Amazon Relational Database Service (RDS) snapshots should be encrypted in order to achieve compliance for data-at-rest encryption within your organization ### Risk Level Medium ### Address Security ### Compliance Standards * APRA CPS 234 (Australia) * AWS Startup Security Baseline * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * DPDPA * Digital Operational Resilience Act (EU) * Essential 8 * GDPR * HIPAA * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST * NIST SP 800-171 * NYDFS 23 NYCRR 500 * Reserve Bank of India (RBI) Cyber Security Framework * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation To remediate the misconfiguration of "Snapshot Encryption Feature Should Be Enabled" for AWS RDS using the AWS console, follow these steps: 1. **Login to AWS Console**: Go to the AWS Management Console ([https://aws.amazon.com/console/](https://aws.amazon.com/console/)) and log in to your AWS account. 2. **Navigate to RDS Service**: Click on the "Services" dropdown menu at the top left corner of the console, then select "RDS" under the Database category. 3. **Select the RDS Instance**: From the list of RDS instances, select the instance for which you want to enable snapshot encryption by clicking on its identifier. 4. **Enable Snapshot Encryption**: * In the RDS instance details page, scroll down to the "Backup" section. * Under the "Backup" section, click on the "Modify" button. 5. **Modify Backup Settings**: * In the Modify DB Instance window, scroll down to the "Backup" section. * Check the box next to "Enable encryption" under the "Backup" section. 6. **Choose Encryption Key**: * Select the KMS key that you want to use for encrypting the RDS snapshots. You can choose an existing KMS key or create a new one. 7. **Save Changes**: * Scroll down to the bottom of the page and click on the "Continue" button. * Review the changes you are about to make and click on the "Modify DB Instance" button to apply the changes. 8. **Monitor Snapshot Encryption**: * Once the modification is completed, monitor the RDS instance to ensure that snapshot encryption is enabled successfully. * You can also create a manual snapshot to verify that the snapshots are encrypted. By following these steps, you can remediate the misconfiguration of enabling the "Snapshot Encryption Feature" for the AWS RDS instance using the AWS console. # To remediate the misconfiguration of Snapshot Encryption feature not being enabled for an AWS RDS instance using AWS CLI, follow these steps: 1. **Identify the RDS Instance**: First, you need to identify the RDS instance for which you want to enable the Snapshot Encryption feature. You can list all your RDS instances using the following AWS CLI command: ```bash theme={null} aws rds describe-db-instances ``` 2. **Enable Snapshot Encryption**: Once you have identified the RDS instance, you can enable the Snapshot Encryption feature by modifying the DB instance with the `--storage-encrypted` parameter set to `true`. Replace `your-db-instance-identifier` with the actual identifier of your RDS instance. ```bash theme={null} aws rds modify-db-instance --db-instance-identifier your-db-instance-identifier --storage-encrypted ``` 3. **Verify Encryption Status**: You can verify the encryption status of your RDS instance by describing the DB instance and checking the value of the `StorageEncrypted` attribute. Replace `your-db-instance-identifier` with the actual identifier of your RDS instance. ```bash theme={null} aws rds describe-db-instances --db-instance-identifier your-db-instance-identifier --query "DBInstances[0].[DBInstanceIdentifier,StorageEncrypted]" ``` 4. **Monitor the Encryption Progress**: The encryption process may take some time depending on the size of your RDS instance and workload. You can monitor the progress by describing the DB instance and checking the `LatestRestorableTime` attribute. Replace `your-db-instance-identifier` with the actual identifier of your RDS instance. ```bash theme={null} aws rds describe-db-instances --db-instance-identifier your-db-instance-identifier --query "DBInstances[0].[DBInstanceIdentifier,LatestRestorableTime]" ``` By following these steps, you can successfully remediate the misconfiguration of enabling the Snapshot Encryption feature for an AWS RDS instance using AWS CLI. To remediate the misconfiguration of Snapshot Encryption not being enabled for AWS RDS using Python, you can follow these steps: 1. Import the necessary Python libraries: ```python theme={null} import boto3 ``` 2. Initialize the AWS RDS client: ```python theme={null} rds = boto3.client('rds') ``` 3. Retrieve a list of all RDS database instances: ```python theme={null} response = rds.describe_db_instances() instances = response['DBInstances'] ``` 4. For each RDS instance, check if snapshot encryption is enabled. If not, enable it: ```python theme={null} for instance in instances: db_instance_identifier = instance['DBInstanceIdentifier'] storage_encrypted = instance['StorageEncrypted'] if not storage_encrypted: print(f"Enabling snapshot encryption for RDS instance {db_instance_identifier}") rds.modify_db_instance( DBInstanceIdentifier=db_instance_identifier, StorageEncrypted=True ) ``` 5. Optionally, you can wait for the modification to be completed: ```python theme={null} waiter = rds.get_waiter('db_instance_modified') waiter.wait(DBInstanceIdentifier=db_instance_identifier) ``` 6. Run the Python script to enable snapshot encryption for all RDS instances. By following these steps, you can remediate the misconfiguration of Snapshot Encryption not being enabled for AWS RDS using Python. ```hcl theme={null} # Encrypted copy of an existing unencrypted RDS snapshot # Substitute: # - SOURCE_SNAPSHOT_ID with the current unencrypted snapshot identifier (e.g. "my-db-snapshot") # - ENCRYPTED_SNAPSHOT_ID with the desired new encrypted snapshot identifier (e.g. "my-db-snapshot-encrypted") # - OPTIONAL_KMS_KEY_ID with a customer-managed KMS key ID/ARN, or keep "alias/aws/rds" for the AWS-managed RDS key resource "aws_db_snapshot_copy" "encrypted_snapshot" { source_db_snapshot_identifier = "SOURCE_SNAPSHOT_ID" target_db_snapshot_identifier = "ENCRYPTED_SNAPSHOT_ID" kms_key_id = "alias/aws/rds" # or "OPTIONAL_KMS_KEY_ID" for a CMK copy_tags = true } ``` This mirrors the CLI fix by creating a new, encrypted copy of the existing snapshot; you then remove the old unencrypted `aws_db_snapshot` (or stop managing it in Terraform) once you have verified the new encrypted snapshot is complete and correct. This change is effectively a replacement: the unencrypted snapshot is not converted in place; a new encrypted snapshot is created and the old one must be deleted separately, which is a destructive operation. Verification: `terraform plan` should show 1 new `aws_db_snapshot_copy` resource to be created, and (once you remove the old one from configuration) the unencrypted `aws_db_snapshot` marked for destruction. ### Additional Reading: * [https://aws.amazon.com/premiumsupport/knowledge-center/encrypt-rds-snapshots/](https://aws.amazon.com/premiumsupport/knowledge-center/encrypt-rds-snapshots/)