DocumentDB cluster should have storage encryption enabled

What it checks

DocumentDB cluster: storage encryption is not enabled.

Where it applies

Terraform: aws_docdb_cluster

CloudFormation: AWS::DocDB::DBCluster

How to fix it

1. Set storage_encrypted = true. DocumentDB encryption can only be enabled at cluster creation, so an existing unencrypted cluster must be recreated (snapshot the unencrypted cluster, restore it as a new cluster with encryption enabled).

Frameworks

• SOC 2 CC6.1
• HIPAA 164.312(a)(2)(iv)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules