Project: KICS (Provisioning / Security & Compliance)
File: 1a690d1d-0ae7-49fa-b2db-b75ae0dd1d3e.md

title: Aurora With Disabled at Rest Encryption hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 1a690d1d-0ae7-49fa-b2db-b75ae0dd1d3e Query name: Aurora With Disabled at Rest Encryption Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Encryption URL: Amazon Aurora does not have encryption for data at rest enabled. To prevent such a scenario, update the attribute 'StorageEncrypted' to 'true'.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="16" provider "aws" { region = "us-west-2" # Replace with your desired AWS region } resource "awsrdscluster" "my_cluster" { cluster_identifier = "my-cluster" engine = "aurora-mysql" engineversion = "5.7.mysqlaurora.2.08.0" master_username = "admin" master_password = "password" backupretentionperiod = 7 preferredbackupwindow = "02:00-03:00" deletion_protection = false skipfinalsnapshot = true apply_immediately = true storage_encrypted = false } resource "awsrdsclusterinstance" "mycluster_instance" { identifier = "my-cluster-instance" clusteridentifier = awsrdscluster.mycluster.id engine = "aurora-mysql" instance_class = "db.r5.large" publicly_accessible = false availability_zone = "us-west-2a" # Replace with your desired availability zone } output "cluster_endpoint" { value = awsrdscluster.my_cluster.endpoint } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="5" provider "aws" { region = "us-west-2" # Replace with your desired AWS region } resource "awsrdscluster" "my_cluster" { cluster_identifier = "my-cluster" engine = "aurora-mysql" engineversion = "5.7.mysqlaurora.2.08.0" master_username = "admin" master_password = "password" backupretentionperiod = 7 preferredbackupwindow = "02:00-03:00" deletion_protection = false skipfinalsnapshot = true apply_immediately = true } resource "awsrdsclusterinstance" "mycluster_instance" { identifier = "my-cluster-instance" clusteridentifier = awsrdscluster.mycluster.id engine = "aurora-mysql" instance_class = "db.r5.large" publicly_accessible = false availability_zone = "us-west-2a" # Replace with your desired availability zone } output "cluster_endpoint" { value = awsrdscluster.my_cluster.endpoint } ``` ```tf title="Negative test num. 1 - tf file" provider "aws" { region = "us-west-2" # Replace with your desired AWS region } resource "awsrdscluster" "my_cluster" { cluster_identifier = "my-cluster" engine = "aurora-mysql" engineversion = "5.7.mysqlaurora.2.08.0" master_username = "admin" master_password = "password" backupretentionperiod = 7 preferredbackupwindow = "02:00-03:00" deletion_protection = false skipfinalsnapshot = true apply_immediately = true storage_encrypted = true } resource "awsrdsclusterinstance" "mycluster_instance" { identifier = "my-cluster-instance" clusteridentifier = awsrdscluster.mycluster.id engine = "aurora-mysql" instance_class = "db.r5.large" publicly_accessible = false availability_zone = "us-west-2a" # Replace with your desired availability zone } output "cluster_endpoint" { value = awsrdscluster.my_cluster.endpoint } ```