RDS cluster snapshots and database snapshots should be encrypted at rest

How to fix it

• Replaces the resource: A snapshot cannot be encrypted where it is: copy it with encryption, wait for the copy to be available, then delete this one (an automated snapshot ages out instead).
• Affects another check: New snapshots of an unencrypted database fail this check too, until the source is encrypted under RDS.3 (instance) or RDS.27 (cluster).

In the console

RDS → Snapshots → Copy snapshot → Encryption

Enable Encryption

Selected

AWS KMS key

A key in the copy's Region; a cluster snapshot needs a customer managed key

With the AWS CLI

aws rds copy-db-snapshot --source-db-snapshot-identifier <source-db-snapshot-identifier> --target-db-snapshot-identifier <target-db-snapshot-identifier> --kms-key-id <kms-key-id> --region <region>

With Terraform

resource "aws_db_snapshot_copy" "encrypted" {
  source_db_snapshot_identifier = var.source_snapshot_arn
  target_db_snapshot_identifier = var.target_snapshot_id
  kms_key_id                    = var.kms_key_arn
}