Project: KICS (Provisioning / Security & Compliance)
File: 5beacce3-4020-4a3d-9e1d-a36f953df630.md

title: RDS Storage Not Encrypted hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 5beacce3-4020-4a3d-9e1d-a36f953df630 Query name: RDS Storage Not Encrypted Platform: CloudFormation Severity: <span style="color:#bb2124">High</span> Category: Encryption URL: RDS Storage should be encrypted, which means the attribute 'StorageEncrypted' should be set to 'true'<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="35" AWSTemplateFormatVersion: 2010-09-09 Description: RDS Storage Encrypted Parameters: SourceDBInstanceIdentifier: Type: String DBInstanceType: Type: String SourceRegion: Type: String Resources: MyKey: Type: "AWS::KMS::Key" Properties: KeyPolicy: Version: 2012-10-17 Id: key-default-1 Statement: Sid: Enable IAM User Permissions Effect: Allow Principal: AWS: !Join "" - "arn:aws:iam::" !Ref "AWS::AccountId" ":root" Action: "kms:*" Resource: "*" MyDBSmall: Type: "AWS::RDS::DBInstance" Properties: DBInstanceClass: !Ref DBInstanceType SourceDBInstanceIdentifier: !Ref SourceDBInstanceIdentifier SourceRegion: !Ref SourceRegion KmsKeyId: !Ref MyKey StorageEncrypted: false ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="30" AWSTemplateFormatVersion: 2010-09-11 Description: RDS Storage Encrypted2 Parameters: SourceDBInstanceIdentifier: Type: String DBInstanceType: Type: String SourceRegion: Type: String Resources: MyKey2: Type: "AWS::KMS::Key" Properties: KeyPolicy: Version: 2012-10-17 Id: key-default-1 Statement: Sid: Enable IAM User Permissions Effect: Allow Principal: AWS: !Join "" - "arn:aws:iam::" !Ref "AWS::AccountId" ":root" Action: "kms:*" Resource: "*" MyDBSmall2: Type: "AWS::RDS::DBInstance" Properties: DBInstanceClass: !Ref DBInstanceType SourceDBInstanceIdentifier: !Ref SourceDBInstanceIdentifier SourceRegion: !Ref SourceRegion KmsKeyId: !Ref MyKey ``` ```json title="Positive test num. 3 - json file" hl_lines="50" { "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Description": "RDS Storage Encrypted", "Parameters": { "SourceDBInstanceIdentifier": { "Type": "String" }, "DBInstanceType": { "Type": "String" }, "SourceRegion": { "Type": "String" } }, "Resources": { "MyKey": { "Type": "AWS::KMS::Key", "Properties": { "KeyPolicy": { "Version": "2012-10-17T00:00:00Z", "Id": "key-default-1", "Statement": [ { "Sid": "Enable IAM User Permissions", "Effect": "Allow", "Principal": { "AWS": [ "", [ "arn:aws:iam::", "AWS::AccountId", ":root" ] ] }, "Action": "kms:*", "Resource": "*" } ] } } }, "MyDBSmall": { "Type": "AWS::RDS::DBInstance", "Properties": { "DBInstanceClass": "DBInstanceType", "SourceDBInstanceIdentifier": "SourceDBInstanceIdentifier", "SourceRegion": "SourceRegion", "KmsKeyId": "MyKey", "StorageEncrypted": false } } } } ``` <details><summary>Positive test num. 4 - json file</summary> ```json hl_lines="45" { "AWSTemplateFormatVersion": "2010-09-11T00:00:00Z", "Description": "RDS Storage Encrypted2", "Parameters": { "SourceDBInstanceIdentifier": { "Type": "String" }, "DBInstanceType": { "Type": "String" }, "SourceRegion": { "Type": "String" } }, "Resources": { "MyKey2": { "Type": "AWS::KMS::Key", "Properties": { "KeyPolicy": { "Statement": [ { "Action": "kms:*", "Resource": "*", "Sid": "Enable IAM User Permissions", "Effect": "Allow", "Principal": { "AWS": [ "", [ "arn:aws:iam::", "AWS::AccountId", ":root" ] ] } } ], "Version": "2012-10-17T00:00:00Z", "Id": "key-default-1" } } }, "MyDBSmall2": { "Type": "AWS::RDS::DBInstance", "Properties": { "SourceRegion": "SourceRegion", "KmsKeyId": "MyKey", "DBInstanceClass": "DBInstanceType", "SourceDBInstanceIdentifier": "SourceDBInstanceIdentifier" } } } } ``` </details> ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: 2010-09-09 Description: RDS Storage Encrypted Parameters: SourceDBInstanceIdentifier: Type: String DBInstanceType: Type: String SourceRegion: Type: String Resources: MyKey: Type: "AWS::KMS::Key" Properties: KeyPolicy: Version: 2012-10-17 Id: key-default-1 Statement: Sid: Enable IAM User Permissions Effect: Allow Principal: AWS: !Join "" - "arn:aws:iam::" !Ref "AWS::AccountId" ":root" Action: "kms:*" Resource: "*" MyDBSmall: Type: "AWS::RDS::DBInstance" Properties: DBInstanceClass: !Ref DBInstanceType SourceDBInstanceIdentifier: !Ref SourceDBInstanceIdentifier SourceRegion: !Ref SourceRegion KmsKeyId: !Ref MyKey StorageEncrypted: true ``` ```json title="Negative test num. 2 - json file" { "Description": "RDS Storage Encrypted", "Parameters": { "SourceRegion": { "Type": "String" }, "SourceDBInstanceIdentifier": { "Type": "String" }, "DBInstanceType": { "Type": "String" } }, "Resources": { "MyDBSmall": { "Type": "AWS::RDS::DBInstance", "Properties": { "SourceDBInstanceIdentifier": "SourceDBInstanceIdentifier", "SourceRegion": "SourceRegion", "KmsKeyId": "MyKey", "StorageEncrypted": true, "DBInstanceClass": "DBInstanceType" } }, "MyKey": { "Type": "AWS::KMS::Key", "Properties": { "KeyPolicy": { "Version": "2012-10-17T00:00:00Z", "Id": "key-default-1", "Statement": [ { "Sid": "Enable IAM User Permissions", "Effect": "Allow", "Principal": { "AWS": [ "", [ "arn:aws:iam::", "AWS::AccountId", ":root" ] ] }, "Action": "kms:*", "Resource": "*" } ] } } } }, "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z" } ```