RDS DB clusters should be encrypted at rest

How to fix it

• Replaces the resource: Encryption cannot be turned on in place: restore a cluster snapshot into a new cluster with your KMS key, give it its DB instances, repoint clients, then delete this cluster.
• Interrupts service: The new cluster holds only what the snapshot captured, so stop writes before taking it or plan to replay them.

In the console

RDS → Snapshots → Restore snapshot, with Encryption set on the new DB cluster (Amazon DocumentDB or Neptune console for those engines)

Encryption key

Customer managed KMS key if you need to control the key; every choice encrypts

AWS KMS key

Your choice of key, settled first: a cluster's key cannot be changed later

With the AWS CLI

aws rds restore-db-cluster-from-snapshot --db-cluster-identifier <new-db-cluster-identifier> --snapshot-identifier <db-cluster-snapshot-identifier> --engine <engine> --kms-key-id <kms-key-id> --region <region>

With Terraform

• Can't be undone: In Terraform storage_encrypted is create-only, so applying it to this cluster replaces it with an empty one.

resource "aws_rds_cluster" "this" {
  engine            = var.engine
  storage_encrypted = true
  kms_key_id        = var.kms_key_arn
}