Neptune DB clusters should be encrypted at rest

How to fix it

• Replaces the resource: Encryption cannot be turned on in place: stop writes, snapshot this cluster, restore the snapshot with encryption on, add DB instances, repoint clients, then delete this cluster.
• Affects another check: Deleting this cluster also clears RDS.27 for it, but its existing snapshots stay unencrypted and keep failing Neptune.6 until they are deleted.

In the console

Neptune → Snapshots → the cluster's snapshot → Actions → Restore snapshot

Enable encryption

Selected, with the aws/rds key or a customer managed key chosen now: the key cannot be changed later

With the AWS CLI

aws neptune restore-db-cluster-from-snapshot --db-cluster-identifier <new-db-cluster-identifier> --snapshot-identifier <db-cluster-snapshot-identifier> --engine neptune --kms-key-id <kms-key-id> --region <region>

With Terraform

• Can't be undone: Do not set storage_encrypted in this cluster's own block: it is create-only, so the apply destroys this cluster instead of encrypting it.

resource "aws_neptune_cluster" "encrypted" {
  cluster_identifier  = var.new_cluster_identifier
  snapshot_identifier = var.snapshot_identifier
  storage_encrypted   = true
  kms_key_arn         = var.kms_key_arn
}