Neptune DB cluster snapshots should be encrypted at rest

How to fix it

• Replaces the resource: A Neptune snapshot cannot be encrypted in place or by copying: restore it with encryption on, snapshot the new cluster, then delete this snapshot (an automated one ages out).
• Affects another check: Every new snapshot of an unencrypted cluster fails this check too, until that cluster is replaced with an encrypted one under Neptune.1.

In the console

Neptune → Snapshots → the snapshot → Actions → Restore snapshot

Enable encryption

Selected, with the aws/rds key or a customer managed key

With the AWS CLI

aws neptune restore-db-cluster-from-snapshot --db-cluster-identifier <new-db-cluster-identifier> --snapshot-identifier <db-cluster-snapshot-identifier> --engine neptune --kms-key-id <kms-key-id> --region <region>

With Terraform

resource "aws_neptune_cluster" "encrypted" {
  cluster_identifier  = var.new_cluster_identifier
  snapshot_identifier = var.snapshot_identifier
  storage_encrypted   = true
  kms_key_arn         = var.kms_key_arn
}