Back to Checks
aws

DocumentDB cluster storage is encrypted at rest

documentdb_cluster_storage_encrypted
Service: documentdbSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsRdsDbCluster

Amazon DocumentDB clusters are assessed for storage encryption at rest via the cluster's encrypted setting.

It identifies clusters where data volumes, automated backups, and snapshots aren't protected by AWS KMS-managed encryption.

Prowler logoProwlerprowler-provider-aws

Risk

Without at-rest encryption, cluster data, snapshots, and backups can be read in plaintext if copies are leaked, mis-shared, or underlying storage is accessed. This harms confidentiality, enables offline analysis and data exfiltration, and widens the blast radius of insider or backup repository compromise.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks documentdb_cluster_storage_encrypted

Recommendation

Enable storage encryption at rest for all DocumentDB clusters and prefer customer-managed KMS keys for control over access, rotation, and revocation. Apply least privilege to key usage, enforce separation of duties, and monitor key and snapshot access. If a cluster isn't encrypted, migrate to a new encrypted cluster.

Remediation

CLI

aws docdb create-db-cluster --db-cluster-identifier <DB_CLUSTER_ID> --engine docdb --master-username <MASTER_USERNAME> --master-user-password <MASTER_PASSWORD> --storage-encrypted

Terraform

# Terraform: Encrypted DocumentDB cluster
resource "aws_docdb_cluster" "<example_resource_name>" {
  master_username   = "<MASTER_USERNAME>"
  master_password   = "<MASTER_PASSWORD>"
  storage_encrypted = true  # Critical: enables encryption at rest to pass the check
}

NativeIaC

# CloudFormation: Create an encrypted DocumentDB cluster
Resources:
  <example_resource_name>:
    Type: AWS::DocDB::DBCluster
    Properties:
      Engine: docdb
      MasterUsername: <MASTER_USERNAME>
      MasterUserPassword: <MASTER_PASSWORD>
      StorageEncrypted: true  # Critical: enables encryption at rest to pass the check

Other

1In the AWS Console, go to Amazon DocumentDB
2Click Create cluster
3Expand Show advanced settings
4In Encryption-at-rest, select Enable encryption
5Choose or keep the default KMS key
6Click Create cluster
7To replace an existing unencrypted cluster:
8Select the unencrypted cluster > Actions > Take snapshot
9After the snapshot completes, select it > Actions > Restore snapshot
10In Encryption-at-rest, select Enable encryption and restore as a new cluster
11Update your applications to use the new cluster endpoint

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.documentdb.documentdb_client import (
    documentdb_client,
)


class documentdb_cluster_storage_encrypted(Check):
    def execute(self):
        findings = []
        for db_cluster in documentdb_client.db_clusters.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=db_cluster)
            if db_cluster.encrypted:
                report.status = "PASS"
                report.status_extended = (
                    f"DocumentDB Cluster {db_cluster.id} is encrypted at rest."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"DocumentDB Cluster {db_cluster.id} is not encrypted at rest."
                )

            findings.append(report)

        return findings

References