Description

Identifies AWS RDS database instances and clusters that are configured without storage encryption in Terraform configurations. Unencrypted RDS storage puts sensitive database content at risk of unauthorized access if the underlying storage is compromised.

Detection Strategy

• Scans Terraform configuration files for AWS RDS resource blocks (aws_db_instance and aws_rds_cluster)

• Checks if storage encryption is explicitly set to false or omitted from the configuration

• Reports a vulnerability when an RDS resource is found with unencrypted storage configuration

• Examines resource attributes and their values to determine the encryption state of the storage

Vulnerable code example

resource "aws_db_instance" "vulnerable_db" {
  allocated_storage = 10
  storage_encrypted = false  # Vulnerable: Database storage is not encrypted at rest
  engine           = "mysql"
  instance_class   = "db.t3.micro"
  name             = "mydb"
  username         = "admin"
  password         = "password123"...

✅ Secure code example

resource "aws_db_instance" "secure_db" {
  allocated_storage       = 10
  storage_encrypted      = true       # Critical: Enable encryption at rest for data security
  engine                 = "mysql"
  engine_version         = "5.7"
  instance_class         = "db.t3.micro"
  name                   = "mydb"
  username               = "admin"...