القائمة
Ensure that encryption-at-rest is enabled for RDS instances
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-aws-foundations-3-2-1يبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
استنادا إلى تصنيف SOC المهني
عرض SKILL.md
| name | cis-aws-foundations-3.2.1 |
| description | Ensure that encryption-at-rest is enabled for RDS instances |
| category | cis-storage |
| version | 7.0.0 |
| author | cyberstrike-official |
| tags | ["cis","aws","storage","rds","encryption","encryption-at-rest","kms"] |
| cis_id | 3.2.1 |
| cis_benchmark | CIS AWS Foundations Benchmark v7.0.0 |
| tech_stack | ["aws"] |
| cwe_ids | [] |
| chains_with | ["cis-aws-foundations-3.2.2","cis-aws-foundations-3.2.3","cis-aws-foundations-3.2.4"] |
| prerequisites | [] |
| severity_boost | {} |
Amazon RDS encrypted DB instances use the industry-standard AES-256 encryption algorithm to encrypt your data on the server that hosts your Amazon RDS DB instances. After your data is encrypted, Amazon RDS handles the authentication of access and the decryption of your data transparently, with minimal impact on performance.
Databases are likely to hold sensitive and critical data; therefore, it is highly recommended to implement encryption to protect your data from unauthorized access or disclosure. With RDS encryption enabled, the data stored on the instance's underlying storage, the automated backups, read replicas, and snapshots are all encrypted.
Enabling encryption requires creating a new encrypted instance from a snapshot. This involves downtime and potential application configuration changes. For production databases, consider implementing replication or planned downtime to ensure data consistency during migration.
Databases.Instance Name to see details, then select the Configuration tab.Encryption Enabled status.Disabled, encryption is not enabled for the selected RDS database instance.describe-db-instances command to list all the RDS database instance names available in the selected AWS region. The output will return each database instance identifier (name):aws rds describe-db-instances --region --query 'DBInstances[*].[DBInstanceIdentifier,StorageEncrypted]' --output table
describe-db-instances command again, using an RDS instance identifier returned from step 1, to determine if the selected database instance is encrypted. The output should return the encryption status True or :Falseaws rds describe-db-instances --region <region-name> --db-instance-identifier <db-name> --query 'DBInstances[*].StorageEncrypted'
False, encryption is not enabled for the selected RDS database instance.The StorageEncrypted parameter should return True for all RDS database instances, indicating that encryption at rest is enabled.
Databases.Actions button placed at the top right and select Take Snapshot.Snapshot Name field and click on Take Snapshot.Action button placed at the top right, and select Copy snapshot from the Action menu.New DB Snapshot Identifier field, enter a name for the new snapshot.Copy Tags. The new snapshot must have the same tags as the source snapshot.Yes from the Enable Encryption dropdown list to enable encryption. You can choose to use the AWS default encryption key or a custom key from the Master Key dropdown list.Copy Snapshot to create an encrypted copy of the selected instance's snapshot.Action button located at the top right. Then, select the Restore Snapshot option from the Action menu. This will restore the encrypted snapshot to a new database instance.Restore DB Instance.Note: This remediation procedure assumes that the database has been taken offline (or operating in read-only mode) and is static when the snapshot is taken. If the database is still in use, any changes made between the time the snapshot is made and the new encrypted database is brought online will be lost.
aws rds describe-db-instances --region <region-name> --query 'DBInstances[*].DBInstanceIdentifier'
aws rds describe-db-instances --region <region-name> --db-instance-identifier <db-name> --query 'DBInstances[*].StorageEncrypted'
aws rds create-db-snapshot --region <region-name> --db-snapshot-identifier <db-snapshot-name> --db-instance-identifier <db-name>
aws kms list-aliases --region <region-name>
aws rds copy-db-snapshot --region <region> \
--source-db-snapshot-identifier <source-snapshot> \
--target-db-snapshot-identifier <target-snapshot> \
--copy-tags \
--kms-key-id <kms-key-id>
aws rds restore-db-instance-from-db-snapshot --region <region> \
--db-instance-identifier <new-db-name> \
--db-snapshot-identifier <snapshot-name>
aws rds create-db-subnet-group \
--db-subnet-group-name <name> \
--db-subnet-group-description <description> \
--subnet-ids '["subnet-1","subnet-2","subnet-3"]'
aws rds restore-db-instance-from-db-snapshot --region <region> \
--db-subnet-group-name <subnet-group> \
--db-instance-identifier <new-db-name> \
--db-snapshot-identifier <snapshot-name>
aws rds describe-db-instances --region <region> --query 'DBInstances[*].DBInstanceIdentifier'
aws rds describe-db-instances --region <region> \
--db-instance-identifier <db-name> \
--query 'DBInstances[*].StorageEncrypted'
By default, Amazon RDS instances are created without encryption at rest. Encryption must be explicitly enabled at instance creation or by restoring from an encrypted snapshot.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 3.11 Encrypt Sensitive Data at Rest | x | x | |
| v7 | 14.8 Encrypt Sensitive Information at Rest | x |
| Techniques / Sub-techniques | Tactics | Mitigations |
|---|---|---|
| T1530 | TA0010 | M1041 |
Level 1 | Automated