RDS Performance Insights uses AWS-managed key (not CMK)

What it checks

RDS Performance Insights uses AWS-managed key (not CMK)

Where it applies

Terraform: aws_rds_cluster_instance, aws_db_instance, aws_rds_cluster

CloudFormation: AWS::RDS::DBInstance, AWS::RDS::DBCluster

How to fix it

1. Set performance_insights_kms_key_id = <CMK arn>. Choose the key when enabling Performance Insights: an existing PI encryption key cannot be changed. Preserve the configured retention period.

Frameworks

• SOC 2 CC6.1
• HIPAA 164.312(a)(2)(iv)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules