AWS RDS Cluster activity streams are not encrypted by Key Management Service (KMS) using Customer Ma

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_246
Category - Subcategory	Storage - Encryption
Provider	AWS
Severity	LOW
Framework	Terraform

Impact

This rule identifies RDS Cluster activity streams which are encrypted with default KMS keys and not with Keys managed by Customer. It is a best practice to use customer managed KMS Keys to encrypt your RDS Cluster activity streams data. It gives you full control over the encrypted data.

How to Fix

Resource: aws_rds_cluster_activity_stream

• Arguments: kms_key_id [source,go]

---

resource "aws_rds_cluster_activity_stream" "pass" { resource_arn = aws_rds_cluster.default.arn mode = "async" kms_key_id = aws_kms_key.default.key_id

depends_on = [aws_rds_cluster_instance.default] }