cis-aws-foundations-3-2-1

name	cis-aws-foundations-3.2.1
description	Ensure that encryption-at-rest is enabled for RDS instances
category	cis-storage
version	7.0.0
author	cyberstrike-official
tags	["cis","aws","storage","rds","encryption","encryption-at-rest","kms"]
cis_id	3.2.1
cis_benchmark	CIS AWS Foundations Benchmark v7.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-foundations-3.2.2","cis-aws-foundations-3.2.3","cis-aws-foundations-3.2.4"]
prerequisites	[]
severity_boost	{}

Ensure that encryption-at-rest is enabled for RDS instances

Description

Amazon RDS encrypted DB instances use the industry-standard AES-256 encryption algorithm to encrypt your data on the server that hosts your Amazon RDS DB instances. After your data is encrypted, Amazon RDS handles the authentication of access and the decryption of your data transparently, with minimal impact on performance.

Rationale

Databases are likely to hold sensitive and critical data; therefore, it is highly recommended to implement encryption to protect your data from unauthorized access or disclosure. With RDS encryption enabled, the data stored on the instance's underlying storage, the automated backups, read replicas, and snapshots are all encrypted.

Impact

Enabling encryption requires creating a new encrypted instance from a snapshot. This involves downtime and potential application configuration changes. For production databases, consider implementing replication or planned downtime to ensure data consistency during migration.

Audit Procedure

Using AWS Console

1. Login to the AWS Management Console and open the RDS dashboard at https://console.aws.amazon.com/rds/.
2. In the navigation pane, under RDS dashboard, click Databases.
3. Select the RDS instance that you want to examine.
4. Click Instance Name to see details, then select the Configuration tab.
5. Under Configuration Details, in the Primary Storage pane, search for the Encryption Enabled status.
6. If the current status is set to Disabled, encryption is not enabled for the selected RDS database instance.
7. Repeat steps 2 to 6 to verify the encryption status of other RDS instances in the same region.
8. Change the region from the top of the navigation bar, and repeat the audit steps for other regions.

Using AWS CLI

1. Run the describe-db-instances command to list all the RDS database instance names available in the selected AWS region. The output will return each database instance identifier (name):

aws rds describe-db-instances --region --query 'DBInstances[*].[DBInstanceIdentifier,StorageEncrypted]' --output table

2. Run the describe-db-instances command again, using an RDS instance identifier returned from step 1, to determine if the selected database instance is encrypted. The output should return the encryption status True or :