RDS instance storage should be encrypted at rest

What it checks

RDS instance: storage is not encrypted at rest.

Where it applies

Terraform: aws_db_instance

CloudFormation: AWS::RDS::DBInstance

How to fix it

1. Set storage_encrypted = true on a new instance. Existing unencrypted DBs require snapshot-copy-encrypt-restore flow.
2. Use a customer-managed KMS key (kms_key_id) for tighter audit control

Frameworks

• AWS FSBP RDS.3
• SOC 2 CC6.1

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules