RDS instances and S3 buckets recorded without encryption at rest

Why unencrypted storage is a compliance blocker

Encryption at rest protects data if the underlying media, a snapshot or a backup ends up somewhere it should not. Most frameworks, including PCI DSS, HIPAA and SOC 2, expect it, and auditors look for it resource by resource.

The two services covered here behave differently. An encrypted RDS instance encrypts its storage, logs, automated backups, read replicas and snapshots with AES-256, but RDS can only encrypt an instance when it is created. S3 has applied SSE-S3 to every new object upload since January 5, 2023, at no cost, but objects uploaded before then are not encrypted retroactively.

Checking encryption status yourself

For RDS:

aws rds describe-db-instances \
  --query 'DBInstances[?StorageEncrypted==`false`].[DBInstanceIdentifier,Engine]' \
  --output table

For an S3 bucket, read its default encryption configuration:

aws s3api get-bucket-encryption --bucket my-bucket \
  --query 'ServerSideEncryptionConfiguration.Rules[].ApplyServerSideEncryptionByDefault'

What ZopNight looks at

The rule covers two resource types, RDS instances and S3 buckets. For each it reads the encryption-at-rest flag recorded during discovery and fires when that flag is false.

Where the rule stops

Any other resource type is out of scope. EBS volumes in particular are handled by EBS Volume Not Encrypted, so the same volume never gets two findings. When the flag is missing or is not a true/false value, no finding is produced.

An S3 finding only says that default encryption was not recorded for the bucket. Given S3’s automatic SSE-S3, the practical gap on an older bucket is usually objects written before 2023, or the lack of a customer-managed KMS key where your policy requires one.

The price of fixing it

The finding carries a $0 saving. SSE-S3 is free. SSE-KMS adds KMS request charges, which an S3 Bucket Key reduces. For RDS, the cost is the migration effort and a short cutover window, not a higher instance rate.

Encrypting what was flagged

For an RDS instance:

1. Create a manual snapshot: aws rds create-db-snapshot --db-instance-identifier my-db --db-snapshot-identifier my-db-plain.
2. Copy it with encryption:

aws rds copy-db-snapshot --source-db-snapshot-identifier my-db-plain \
  --target-db-snapshot-identifier my-db-encrypted --kms-key-id alias/my-rds-key

3. Restore a new instance from the encrypted copy with aws rds restore-db-instance-from-db-snapshot, then point applications at the new endpoint and retire the old instance.

For an S3 bucket:

1. Set default encryption, choosing SSE-KMS with a Bucket Key if you need key-level audit control: aws s3api put-bucket-encryption.
2. Re-encrypt objects written before 2023 with S3 Batch Operations copy jobs.