Back to Checks
aws

Neptune DB cluster snapshot is encrypted at rest

neptune_cluster_snapshot_encrypted
Service: neptuneSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsRdsDbClusterSnapshot

Neptune DB cluster snapshot is encrypted at rest. The evaluation looks at whether each snapshot's encrypted attribute is enabled, confirming that the data is protected while stored.

Prowler logoProwlerprowler-provider-aws

Risk

Unencrypted Neptune snapshots undermine data confidentiality. If accessed or shared due to compromised credentials or misconfiguration, attackers can restore or download snapshot contents, enabling data exfiltration, and exposure of sensitive records. This weakens overall data protection posture.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks neptune_cluster_snapshot_encrypted

Recommendation

Protect snapshot data by enforcing encryption at rest and strong key governance.

  • Use customer-managed keys with controlled lifecycle and rotation
  • Apply least privilege to snapshot access and sharing
  • Prevent creation of unencrypted snapshots via organizational configuration and policy controls

Remediation

CLI

aws rds copy-db-cluster-snapshot --source-db-cluster-snapshot-identifier <source-snapshot> --target-db-cluster-snapshot-identifier <encrypted-snapshot> --kms-key-id <kms-key-id>

Terraform

resource "aws_neptune_cluster" "restored" {
  cluster_identifier  = "restored-cluster"
  snapshot_identifier = "<source-snapshot>"
  storage_encrypted   = true  # Ensure restored cluster from snapshot is encrypted
}

Other

1Sign in to the AWS Management Console and open Amazon Neptune
2In the left pane choose **Snapshots**
3Select the unencrypted snapshot and click **Actions** > **Restore snapshot**
4In the Restore page enable **Encryption** and select a KMS key
5Click **Restore DB cluster**
6After the cluster is restored, create a new snapshot of the restored (encrypted) cluster

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.neptune.neptune_client import neptune_client


class neptune_cluster_snapshot_encrypted(Check):
    def execute(self):
        findings = []
        for snapshot in neptune_client.db_cluster_snapshots:
            report = Check_Report_AWS(metadata=self.metadata(), resource=snapshot)
            report.status = "FAIL"
            report.status_extended = (
                f"Neptune Cluster Snapshot {snapshot.id} is not encrypted at rest."
            )
            if snapshot.encrypted:
                report.status = "PASS"
                report.status_extended = (
                    f"Neptune Cluster Snapshot {snapshot.id} is encrypted at rest."
                )

            findings.append(report)

        return findings

References