Aurora cluster has no explicit customer-managed key choice

What it checks

Aurora cluster: no explicit customer-managed KMS key choice is demonstrated.

Where it applies

Terraform: aws_rds_cluster

CloudFormation: AWS::RDS::DBCluster

How to fix it

1. Inspect the cluster's actual encryption type and key, including snapshot, clone or replication sources. If customer key control is required, plan a supported migration with storage_encrypted = true and an explicit customer-managed kms_key_id; validate restore and application cutover before replacement.

Frameworks

• SOC 2 CC6.1
• HIPAA 164.312(a)(2)(iv)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules