Back to Checks
alibabacloud

RDS instance has Transparent Data Encryption enabled

rds_instance_tde_enabled
Service: rdsSeverity: high
OfficialBuilt-inVerified
Categories:encryption
Resource Type:ALIYUN::RDS::DBInstance

Alibaba Cloud RDS instances should have Transparent Data Encryption (TDE) enabled. TDE performs real-time encryption and decryption of the database, associated backups, and log files at rest, without requiring changes to the application. This check verifies that TDE is enabled to protect sensitive data stored in the RDS instance from unauthorized physical access.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

Data at rest that is not encrypted is vulnerable to unauthorized access if the underlying storage media or backups are compromised, stolen, or improperly decommissioned. Without TDE, attackers with physical or administrative access to the storage layer can read sensitive data directly, impacting confidentiality and potentially leading to data breaches.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks rds_instance_tde_enabled

Recommendation

Enable Transparent Data Encryption (TDE) on all applicable RDS instances to protect data at rest from unauthorized physical access.

Remediation

CLI

aliyun rds ModifyDBInstanceTDE --DBInstanceId <instance_id> --TDEStatus Enabled

Terraform

resource "alicloud_db_instance" "example" {
  engine           = "MySQL"
  engine_version   = "8.0"
  instance_type    = "rds.mysql.s1.small"
  instance_storage = 20
  tde_status       = "Enabled"
}

Other

1Log on to the **RDS Console**.
2Select the target RDS instance.
3Go to **Data Security** > **TDE** tab.
4Find TDE Status and click the switch next to **Disabled**.
5Choose automatically generated key or custom key.
6Click **Confirm**.

Check Code

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.rds.rds_client import rds_client


class rds_instance_tde_enabled(Check):
    """Check if TDE is set to Enabled for applicable database instance."""

    def execute(self) -> list[CheckReportAlibabaCloud]:
        findings = []

        for instance in rds_client.instances:
            report = CheckReportAlibabaCloud(
                metadata=self.metadata(), resource=instance
            )
            report.region = instance.region
            report.resource_id = instance.id
            report.resource_arn = f"acs:rds:{instance.region}:{rds_client.audited_account}:dbinstance/{instance.id}"

            if instance.tde_status == "Enabled":
                report.status = "PASS"
                report.status_extended = (
                    f"RDS Instance {instance.name} has TDE enabled."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"RDS Instance {instance.name} does not have TDE enabled."
                )

            findings.append(report)

        return findings

References