Control: 27 RDS DB clusters should be encrypted at rest
Description
This control checks if an RDS DB cluster is encrypted at rest. The control fails if an RDS DB cluster isn't encrypted at rest.
Data at rest refers to any data that's stored in persistent, non-volatile storage for any duration. Encryption helps you protect the confidentiality of such data, reducing the risk that an unauthorized user can access it. Encrypting your RDS DB clusters protects your data and metadata against unauthorized access. It also fulfills compliance requirements for data-at-rest encryption of production file systems.
Remediation
You can enable encryption at rest when you create an RDS DB cluster. You can't change encryption settings after creating a cluster. For more information, see Encrypting an Amazon Aurora DB cluster in the Amazon Aurora User Guide.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.foundational_security_rds_27Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.foundational_security_rds_27 --shareSQL
This control uses a named query:
rds_db_cluster_encryption_at_rest_enabled