Amazon DocumentDB clusters should be encrypted at rest

How to fix it

• Replaces the resource: Encryption cannot be turned on in place: restore a snapshot of this cluster into a new encrypted cluster, give it instances, repoint clients, then delete this cluster.
• Interrupts service: The new cluster holds only what the snapshot captured, so stop writes before taking it or plan to replay them.

In the console

Amazon DocumentDB → Snapshots → the snapshot of this cluster → Actions → Restore → Encryption

Encryption at rest

Enable encryption-at-rest

AWS KMS Key

(default) aws/rds, or a customer managed key to control access; settle it first, it cannot change later

With the AWS CLI

aws docdb restore-db-cluster-from-snapshot --db-cluster-identifier <new-cluster-identifier> --snapshot-identifier <cluster-snapshot-identifier> --engine docdb --kms-key-id <kms-key-arn> --region <region>

With Terraform

• Can't be undone: storage_encrypted forces a new cluster, so setting it on this cluster's existing block plans its replacement by an empty one; declare the restored cluster as its own block.

resource "aws_docdb_cluster" "encrypted" {
  cluster_identifier  = var.new_cluster_identifier
  snapshot_identifier = var.snapshot_identifier
  storage_encrypted   = true
  kms_key_id          = var.kms_key_arn
}