Project: KICS (Provisioning / Security & Compliance)
File: 08bd0760-8752-44e1-9779-7bb369b2b4e4.md

title: DB Instance Storage Not Encrypted hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 08bd0760-8752-44e1-9779-7bb369b2b4e4 Query name: DB Instance Storage Not Encrypted Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Encryption URL: AWS DB Instance should have its storage encrypted by setting the parameter to 'true'. The storage_encrypted default value is 'false'.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="11 14" resource "awsdbinstance" "positive1" { allocated_storage = 20 storage_type = "gp2" engine = "mysql" engine_version = "5.7" instance_class = "db.t2.micro" name = "mydb" username = "foo" password = "foobarbaz" iamdatabaseauthentication_enabled = false storage_encrypted = false } resource "awsdbinstance" "positive2" { allocated_storage = 20 storage_type = "gp2" engine = "mysql" engine_version = "5.7" instance_class = "db.t2.micro" name = "mydb" username = "foo" password = "foobarbaz" } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="1" module "db" { source = "terraform-aws-modules/rds/aws" version = "~> 3.0" identifier = "demodb" engine = "mysql" engine_version = "5.7.19" instance_class = "db.t2.large" allocated_storage = 5 name = "demodb" username = "user" password = "YourPwdShouldBeLongAndSecure!" port = "3306" iamdatabaseauthentication_enabled = true vpcsecuritygroup_ids = ["sg-12345678"] maintenance_window = "Mon:00:00-Mon:03:00" backup_window = "03:00-06:00" monitoring_interval = "30" monitoringrolename = "MyRDSMonitoringRole" createmonitoringrole = true tags = { Owner = "user" Environment = "dev" } subnet_ids = ["subnet-12345678", "subnet-87654321"] family = "mysql5.7" majorengineversion = "5.7" deletion_protection = true parameters = [ { name = "charactersetclient" value = "utf8mb4" }, { name = "charactersetserver" value = "utf8mb4" } ] options = [ { optionname = "MARIADBAUDIT_PLUGIN" option_settings = [ { name = "SERVERAUDITEVENTS" value = "CONNECT" }, { name = "SERVERAUDITFILE_ROTATIONS" value = "37" }, ] }, ] } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="11" module "db" { source = "terraform-aws-modules/rds/aws" version = "~> 3.0" identifier = "demodb" engine = "mysql" engine_version = "5.7.19" instance_class =

allocated_storage = 5 storage_encrypted = false name = "demodb" username = "user" password = "YourPwdShouldBeLongAndSecure!" port = "3306" iamdatabaseauthentication_enabled = true vpcsecuritygroup_ids = ["sg-12345678"] maintenance_window = "Mon:00:00-Mon:03:00" backup_window = "03:00-06:00" monitoring_interval = "30" monitoringrolename = "MyRDSMonitoringRole" createmonitoringrole = true tags = { Owner = "user" Environment = "dev" } subnet_ids = ["subnet-12345678", "subnet-87654321"] family = "mysql5.7" majorengineversion = "5.7" deletion_protection = true parameters = [ { name = "charactersetclient" value = "utf8mb4" }, { name = "charactersetserver" value = "utf8mb4" } ] options = [ { optionname = "MARIADBAUDIT_PLUGIN" option_settings = [ { name = "SERVERAUDITEVENTS" value = "CONNECT" }, { name = "SERVERAUDITFILE_ROTATIONS" value = "37" }, ] }, ] } ``` ```tf title="Negative test num. 1 - tf file" resource "awsdbinstance" "negative1" { allocated_storage = 20 storage_type = "gp2" engine = "mysql" engine_version = "5.7" instance_class = "db.t2.micro" name = "mydb" username = "foo" password = "foobarbaz" iamdatabaseauthentication_enabled = true storage_encrypted = true } resource "awsdbinstance" "negative2" { allocated_storage = 20 storage_type = "gp2" engine = "mysql" engine_version = "5.7" instance_class = "db.t2.micro" name = "mydb" username = "foo" password = "foobarbaz" iamdatabaseauthentication_enabled = false kmskeyid = awskmskey.mykey.keyid } ``` ```tf title="Negative test num. 2 - tf file" module "db" { source = "terraform-aws-modules/rds/aws" version = "~> 3.0" identifier = "demodb" engine = "mysql" engine_version = "5.7.19" instance_class = "db.t2.large" allocated_storage = 5 storage_encrypted = true name = "demodb" username = "user" password = "YourPwdShouldBeLongAndSecure!" port = "3306" iamdatabaseauthentication_enabled = true vpcsecuritygroup_ids = ["sg-12345678"] maintenance_window = "Mon:00:00-Mon:03:00" backup_window = "03:00-06:00" monitoring_interval = "30" monitoringrolename = "MyRDSMonitoringRole" createmonitoringrole = true tags = { Owner = "user" Environment = "dev" } subnet_ids = ["subnet-12345678", "subnet-87654321"] family = "mysql5.7" majorengineversion = "5.7" deletion_protection = true parameters = [ { name = "charactersetclient" value = "utf8mb4" }, { name = "charactersetserver" value = "utf8mb4" } ] options = [ { optionname = "MARIADBAUDIT_PLUGIN" option_settings = [ { name = "SERVERAUDITEVENTS" value = "CONNECT" }, { name = "SERVERAUDITFILE_ROTATIONS" value = "37" }, ] }, ] } ```