Control: 6 Neptune DB cluster snapshots should be encrypted at rest
Description
This control checks whether a Neptune DB cluster snapshot is encrypted at rest. The control fails if a Neptune DB cluster isn't encrypted at rest.
Data at rest refers to any data that's stored in persistent, non-volatile storage for any duration. Encryption helps you protect the confidentiality of such data, reducing the risk that an unauthorized user gets access to it. Data in Neptune DB clusters snapshots should be encrypted at rest for an added layer of security.
Remediation
You can't encrypt an existing Neptune DB cluster snapshot. Instead, you must restore the snapshot to a new DB cluster and enable encryption on the cluster. You can create an encrypted snapshot from the encrypted cluster. For instructions, see Restoring from a DB cluster snapshot and Creating a DB cluster snapshot in Neptune in the Neptune User Guide.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.foundational_security_neptune_6Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.foundational_security_neptune_6 --shareSQL
This control uses a named query:
select db_cluster_snapshot_arn as resource, case when storage_encrypted then 'ok' else 'alarm' end as status, case when storage_encrypted then title || ' encrypted at rest.' else title || ' not encrypted at rest.' end as reason , region, account_idfrom aws_neptune_db_cluster_snapshot;