Project: KICS (Provisioning / Security & Compliance)
File: bf4473f1-c8a2-4b1b-8134-bd32efabab93.md

title: Neptune Database Cluster Encryption Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: bf4473f1-c8a2-4b1b-8134-bd32efabab93 Query name: Neptune Database Cluster Encryption Disabled Platform: CloudFormation Severity: <span style="color:#bb2124">High</span> Category: Encryption URL: Neptune database cluster storage should have encryption enabled<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="27" AWSTemplateFormatVersion: 2010-09-09 Description: A sample template Resources: NeptuneDBCluster: Type: AWS::Neptune::DBCluster Properties: AssociatedRoles: DBClusterRole AvailabilityZones: String DBClusterIdentifier: String DBClusterParameterGroupName: String DBSubnetGroupName: String DeletionProtection: true EnableCloudwatchLogsExports: String EngineVersion: String IamAuthEnabled: true KmsKeyId: String Port: 8182 PreferredBackupWindow: String PreferredMaintenanceWindow: String RestoreToTime: String RestoreType: String SnapshotIdentifier: String SourceDBClusterIdentifier: String StorageEncrypted: false Tags: Tag UseLatestRestorableTime: true VpcSecurityGroupIds: String ``` ```json title="Positive test num. 2 - json file" hl_lines="21" { "Resources": { "NeptuneDBCluster": { "Type": "AWS::Neptune::DBCluster", "Properties": { "DBClusterIdentifier": "String", "EnableCloudwatchLogsExports": [ "String" ], "EngineVersion": "String", "Port": 8182, "SourceDBClusterIdentifier": "String", "Tags": [ "Tag" ], "AssociatedRoles": [ "DBClusterRole" ], "DBSubnetGroupName": "String", "RestoreToTime": "String", "StorageEncrypted": false, "UseLatestRestorableTime": true, "DBClusterParameterGroupName": "String", "PreferredBackupWindow": "String", "SnapshotIdentifier": "String", "IamAuthEnabled": true, "DeletionProtection": true, "KmsKeyId": "String", "PreferredMaintenanceWindow": "String", "RestoreType": "String", "VpcSecurityGroupIds": [ "String" ], "AvailabilityZones": [ "String" ] } } }, "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Description": "A sample template" } ``` ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: 2010-09-09 Description: A sample template Resources: NeptuneDBCluster: Type: AWS::Neptune::DBCluster Properties: AssociatedRoles: DBClusterRole AvailabilityZones: String DBClusterIdentifier: String DBClusterParameterGroupName: String DBSubnetGroupName: String DeletionProtection: true EnableCloudwatchLogsExports: String EngineVersion: String IamAuthEnabled: true KmsKeyId: String Port: 8182 PreferredBackupWindow: String PreferredMaintenanceWindow: String RestoreToTime: String RestoreType: String SnapshotIdentifier: String SourceDBClusterIdentifier: String StorageEncrypted: true Tags: Tag UseLatestRestorableTime: true VpcSecurityGroupIds: String ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Description": "A sample template", "Resources": { "NeptuneDBCluster": { "Type": "AWS::Neptune::DBCluster", "Properties": { "AvailabilityZones": [ "String" ], "VpcSecurityGroupIds": [ "String" ], "Tags": [ "Tag" ], "EnableCloudwatchLogsExports": [ "String" ], "EngineVersion": "String", "IamAuthEnabled": true, "KmsKeyId": "String", "PreferredMaintenanceWindow": "String", "RestoreToTime": "String", "SnapshotIdentifier": "String", "AssociatedRoles": [ "DBClusterRole" ], "DBClusterIdentifier": "String", "DBClusterParameterGroupName": "String", "DeletionProtection": true, "Port": 8182, "PreferredBackupWindow": "String", "StorageEncrypted": true, "DBSubnetGroupName": "String", "RestoreType": "String", "SourceDBClusterIdentifier": "String", "UseLatestRestorableTime": true } } } } ```