Amazon DocumentDB clusters should be encrypted at rest
Description
This control checks whether an Amazon DocumentDB cluster is encrypted at rest. The control fails if an Amazon DocumentDB cluster isn't encrypted at rest. Data at rest refers to any data that's stored in persistent, non-volatile storage for any duration. Encryption helps you protect the confidentiality of such data, reducing the risk that an unauthorized user gets access to it. Data in Amazon DocumentDB clusters should be encrypted at rest for an added layer of security. Amazon DocumentDB uses the 256-bit Advanced Encryption Standard (AES-256) to encrypt your data using encryption keys stored in AWS Key Management Service (AWS KMS).
Remediation
Enable encryption at rest for your Amazon DocumentDB clusters. You cannot enable encryption at rest for an existing cluster, so you must create a new cluster with encryption enabled.
Steps
- Open the Amazon DocumentDB console.
- Choose 'Clusters' from the navigation pane.
- Create a new cluster or modify an existing one.
- In the 'Encryption' section, select 'Enable encryption'.
- Choose an AWS KMS key (either AWS managed or customer managed).
- Complete the cluster creation or modification process.