Back to Checks
aws

RDS cluster storage is encrypted

rds_cluster_storage_encrypted
Service: rdsSeverity: high
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsRdsDbCluster

RDS DB clusters are assessed for encryption at rest via AWS KMS. It determines whether cluster storage-and related artifacts like automated backups and snapshots-are encrypted with a KMS key.

Prowler logoProwlerprowler-provider-aws

Risk

Unencrypted clusters expose data on disk, logs, and snapshots to unauthorized reading if storage or backups are obtained. This compromises confidentiality, enables offline exfiltration from leaked snapshots, and can widen blast radius during incidents and migrations.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks rds_cluster_storage_encrypted

Recommendation

Create clusters with StorageEncrypted=true using AWS KMS, preferably customer-managed keys. Apply least privilege to key usage, enable rotation and monitoring, and separate key administration from DB operations. Ensure snapshots and cross-account copies remain encrypted for defense in depth.

Remediation

Terraform

# Terraform: Create an encrypted RDS/Aurora DB cluster
resource "aws_rds_cluster" "<example_resource_name>" {
  engine          = "<ENGINE>"
  master_username = "<MASTER_USERNAME>"
  master_password = "<MASTER_PASSWORD>"
  storage_encrypted = true  # Critical: enables encryption at rest for the cluster
}

NativeIaC

# CloudFormation: Create an encrypted RDS/Aurora DB cluster
Resources:
  <example_resource_name>:
    Type: AWS::RDS::DBCluster
    Properties:
      Engine: <ENGINE>
      MasterUsername: <MASTER_USERNAME>
      MasterUserPassword: <MASTER_PASSWORD>
      StorageEncrypted: true  # Critical: enables encryption at rest for the cluster

Other

1In the AWS Console, go to RDS > Databases > Create database
2Select your engine (Aurora or Multi-AZ DB cluster)
3In the configuration, enable Storage encryption (Enable encryption)
4Leave the KMS key as default (aws/rds or aws/aurora) unless you require a custom key
5Create the cluster, migrate traffic, then delete the unencrypted cluster

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.rds.rds_client import rds_client


class rds_cluster_storage_encrypted(Check):
    def execute(self):
        findings = []
        for db_cluster in rds_client.db_clusters.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=db_cluster)
            if db_cluster.encrypted:
                report.status = "PASS"
                report.status_extended = f"RDS cluster {db_cluster.id} is encrypted."
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"RDS cluster {db_cluster.id} is not encrypted."
                )

            findings.append(report)

        return findings

References