Skip to main content

AWS RDS Aurora cluster should be encrypted

  • GG_ID: GG_IAC_0059
  • Severity: HIGH
  • Complexity: LOW
  • Categories: DATA, PERMISSION
  • Providers: AWS
  • Potential data exposure: True
  • Visible in logs: False
  • User interaction required: False
  • Privileges required: True


Amazon Relational Database Service (Amazon RDS) is a web service that makes it easier to set up, operate, and scale a relational database in the AWS Cloud. An RDS Aurora cluster is a group of DB instances.

The data should always be encrypted at rest to protect the data if accesses are compromised.


Not encrypting data could lead to data leak in case of an attack.

Remediation guidelines#

Since it is not possible to encrypt an existing unencrypted cluster, the following manual steps must be performed if there is already an unencrypted cluster:

  1. Create an unencrypted snapshot of the cluster.
  2. Restore the unencrypted snapshot to a new encrypted Aurora DB cluster. For more information, see

External documentation#