Back to Checks
huaweicloud

RDS instances should have disk encryption enabled

rds_instance_disk_encryption
Service: rdsSeverity: high
OfficialBuilt-inVerified
Categories:encryption
Resource Type:NotDefined

Ensure that Huawei Cloud Relational Database Service (RDS) instances have storage disk encryption enabled using a Key Management Service (KMS) key.

Prowler logoProwlerprowler-provider-huaweicloud

Risk

RDS instances without disk encryption store data at rest in plaintext, which may expose sensitive information if the underlying storage is compromised.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler huaweicloud --checks rds_instance_disk_encryption

Recommendation

Enable disk encryption on all RDS instances using a customer-managed KMS key.

Remediation

CLI

hcloud RDS CreateInstance --instance.disk_encryption_id=<kms_key_id> --instance.name=<name> --instance.datastore.type=<engine>

Other

1Log on to the **Huawei Cloud console**
2Navigate to **Relational Database Service**
3Select the instance
4Click **More** > **Manage Disk Encryption**
5Enable disk **encryption** and select a **KMS** key

Check Code

from prowler.lib.check.models import Check, CheckReportHuaweiCloud
from prowler.providers.huaweicloud.services.rds.rds_client import rds_client


class rds_instance_disk_encryption(Check):
    """Ensure RDS instances have disk encryption enabled."""

    def execute(self) -> list[CheckReportHuaweiCloud]:
        findings = []

        for instance in rds_client.instances:
            report = CheckReportHuaweiCloud(metadata=self.metadata(), resource=instance)
            report.region = instance.region
            report.resource_id = instance.id
            report.resource_arn = f"huaweicloud:rds:{instance.region}:{rds_client.audited_account}:instance/{instance.id}"

            if instance.disk_encryption_id:
                report.status = "PASS"
                report.status_extended = (
                    f"RDS instance {instance.name} ({instance.id}) has disk encryption enabled "
                    f"with KMS key {instance.disk_encryption_id}."
                )
            else:
                report.status = "FAIL"
                report.status_extended = f"RDS instance {instance.name} ({instance.id}) does not have disk encryption enabled."

            findings.append(report)

        return findings

References