DocumentDB is not encrypted at rest misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_74
Category - Subcategory	Storage - Encryption
Provider	AWS
Severity	MEDIUM
Framework	CloudFormation, Serverless, Terraform, Terraform Plan

Impact

This rule ensures that Amazon DocumentDB (DocDB) clusters are encrypted at rest. Encrypting data at rest protects the data stored in your DocDB clusters from unauthorized access and potential data breaches. By default, DocDB clusters are unencrypted, so it is crucial to enable encryption to secure your data.

How to Fix

To fix this issue, ensure that the StorageEncrypted property in the AWS::DocDB::DBCluster resource is set to true.

Example: [source,go]

{ "Resources": { "MyDocDBCluster": { "Type": "AWS::DocDB::DBCluster", "Properties": {

• "StorageEncrypted": true, ... } } } }

---

Resources: MyDocDBCluster: Type: AWS::DocDB::DBCluster Properties:

• StorageEncrypted: true ...

---