RDS Instances Should Have Encryption Enabled

Using Console

To remediate the misconfiguration of RDS instances not having encryption enabled in AWS, you can follow these steps using the AWS Management Console:

Login to AWS Console: Go to the AWS Management Console and login with your credentials.
Navigate to RDS Dashboard: Click on the “Services” dropdown menu at the top of the page and select “RDS” under the Database category.
Create a Snapshot of the Unencrypted DB Instance a. Select your DB instance. b. Click on Actions and choose Take snapshot. c. Provide a unique Snapshot Identifier and create the snapshot. d. Copy the Snapshot with Encryption
Create Encrypted Snapshot from Unencrypted Snapshot a. In the RDS Dashboard, go to Snapshots and select the snapshot you just created. b. Click on Actions and choose Copy snapshot. c. In the copy dialog, enable Encryption by selecting your desired AWS KMS key. d. Specify a new identifier for the encrypted snapshot and start the copy process.
Restore a New Encrypted DB Instance from the Encrypted Snapshot a. Once the encrypted snapshot is available, select it. b. Click on Actions and choose Restore snapshot. c. Provide a new DB instance identifier and adjust the instance settings as needed. d. Launch the new encrypted instance.

By following these steps, you can remediate the misconfiguration of RDS instances without encryption enabled using AWS Console.

Using CLI

Amazon RDS does not support enabling encryption on an existing unencrypted DB instance. However, you can achieve encryption by creating a new encrypted instance and migrating the data. Here are the steps for AWS CLI:

Identify the RDS Instances without Encryption Enabled: Run the following AWS CLI command to list all RDS instances without encryption enabled:
aws rds describe-db-instances --query "DBInstances[?StorageEncrypted==\`false\`].DBInstanceIdentifier"
Create a Snapshot: For each RDS instance identified in the previous step, create a db snapshot using the following command:
aws rds create-db-snapshot \ --db-instance-identifier <db-instance-id> \ --db-snapshot-identifier <snapshot-id>
Replace <instance-identifier> with the identifier of the RDS instance that needs encryption enabled.
Iterate through all the instances and perform below steps:

Copy the Snapshot with Encryption Enabled:

aws rds copy-db-snapshot \
  --source-db-snapshot-identifier <snapshot-id> \
  --target-db-snapshot-identifier <encrypted-snapshot-id> \
  --kms-key-id <kms-key-id>

Replace <snapshot-id> with the RDS instance snapshot identifier created in the above step.

Restore a New Encrypted DB Instance from the Encrypted Snapshot: Once the encryption modification is complete, verify that encryption is enabled for the RDS instance by running:
aws rds restore-db-instance-from-db-snapshot \ --db-instance-identifier <new-db-instance-id> \ --db-snapshot-identifier <encrypted-snapshot-id>
Replace <encrypted-snapshot-id> with the Encrypted snapshot identifier created in the above step.

(Optional) Delete Old Unencrypted Instances:

for db in $(aws rds describe-db-instances --query "DBInstances[?StorageEncrypted==\`false\`].DBInstanceIdentifier" --output text); do
  aws rds delete-db-instance --db-instance-identifier $db --skip-final-snapshot
  echo "Deleted old unencrypted instance: $db"
done

By following these steps, you can remediate the misconfiguration of RDS instances not having encryption enabled in AWS using AWS CLI.

Using Python

Import the necessary Python libraries:
import boto3
Initialize the AWS RDS client:
client = boto3.client('rds')

Get a list of all RDS instances:

response = client.describe_db_instances()

Create a snapshot of the current unencrypted DB instance:

 # Step 1: Create a snapshot
 snapshot_id = f"{db_instance}-unencrypted-snapshot"
 print(f"Creating snapshot: {snapshot_id}")
 rds_client.create_db_snapshot(DBInstanceIdentifier=db_instance, DBSnapshotIdentifier=snapshot_id)

 # Wait until snapshot is available
 waiter = rds_client.get_waiter('db_snapshot_available')
 waiter.wait(DBSnapshotIdentifier=snapshot_id)
 print(f"Snapshot {snapshot_id} is now available.")

Create new snapshot with Encryption:

 # Step 2: Copy the snapshot with encryption
 encrypted_snapshot_id = f"{db_instance}-encrypted-snapshot"
 print(f"Copying snapshot with encryption: {encrypted_snapshot_id}")
 rds_client.copy_db_snapshot(
     SourceDBSnapshotIdentifier=snapshot_id,
     TargetDBSnapshotIdentifier=encrypted_snapshot_id,
     KmsKeyId=kms_key_id
 )

 # Wait until encrypted snapshot is available
 waiter.wait(DBSnapshotIdentifier=encrypted_snapshot_id)
 print(f"Encrypted snapshot {encrypted_snapshot_id} is now available.")

Restore to create a new Encrypted database:

 # Step 3: Restore a new encrypted DB instance
 new_db_instance = f"{db_instance}-encrypted"
 print(f"Restoring new encrypted DB instance: {new_db_instance}")
 rds_client.restore_db_instance_from_db_snapshot(
     DBInstanceIdentifier=new_db_instance,
     DBSnapshotIdentifier=encrypted_snapshot_id
 )

 # Step 4: Wait for the new DB instance to be available
 db_waiter = rds_client.get_waiter('db_instance_available')
 db_waiter.wait(DBInstanceIdentifier=new_db_instance)
 print(f"New encrypted DB instance {new_db_instance} is now available.")

Make sure you have the necessary IAM permissions to describe and modify RDS instances. Also, ensure that you have the AWS SDK for Python (Boto3) installed.This script will iterate through all RDS instances in your AWS account, check if encryption is enabled, take a snapshot, create a new encrypted snapshot, and create new database using encrypted snapshot.

Using Terraform

resource "aws_db_instance" "THIS_DB" {
  # Replace with the identifier of the RDS instance
  identifier = "EXISTING_DB_IDENTIFIER"

  # ... all your existing required arguments ...
  engine               = "ENGINE_NAME"          # e.g. "mysql"
  engine_version       = "ENGINE_VERSION"       # e.g. "8.0.35"
  instance_class       = "DB_INSTANCE_CLASS"    # e.g. "db.m6g.large"
  allocated_storage    = 20
  username             = "MASTER_USERNAME"
  password             = "MASTER_PASSWORD"
  db_subnet_group_name = aws_db_subnet_group.DB_SUBNET_GROUP.name
  vpc_security_group_ids = [
    aws_security_group.DB_SG.id,
  ]

  # Enable storage encryption at rest
  storage_encrypted = true

  # Optional: use a customer-managed KMS key instead of the default RDS key
  # kms_key_id = aws_kms_key.RDS_ENCRYPTION_KEY.arn

  # ... any other existing settings ...
}

Enabling storage_encrypted = true on an RDS instance that was originally created unencrypted forces replacement: Terraform will destroy the existing instance and create a new, encrypted one. To avoid data loss, follow AWS guidance to create an encrypted snapshot from an unencrypted snapshot and restore it into a new encrypted instance, then import that into Terraform or adjust your state accordingly before applying.After updating Terraform, terraform plan should show the aws_db_instance.THIS_DB resource with storage_encrypted changing from false (or being added) to true, and it will be marked with -/+ indicating it will be replaced.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

RDS Instances Should Have Encryption Enabled

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​Additional Reading: