Neptune database cluster encryption disabled

이 제품은 선택한 Datadog 사이트에서 지원되지 않습니다. ().
이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Metadata

Id: cloudformation-aws-neptune-database-cluster-encryption-disabled

Provider: AWS

Platform: CloudFormation

Severity: High

Category: Encryption

Learn More

Description

Neptune DB cluster storage must be encrypted to protect data at rest, including cluster volumes, automated snapshots, and backups, from unauthorized access or disclosure. In AWS CloudFormation, the StorageEncrypted property on AWS::Neptune::DBCluster must be defined and set to true. Resources missing this property or with StorageEncrypted set to false will be flagged. Optionally specify a customer-managed KMS key with KmsKeyId if you need control over encryption keys.

Secure configuration example:

MyNeptuneCluster:
  Type: AWS::Neptune::DBCluster
  Properties:
    StorageEncrypted: true
    KmsKeyId: arn:aws:kms:us-east-1:123456789012:key/abcd1234-ef56-7890-abcd-1234ef567890

Compliant Code Examples

AWSTemplateFormatVersion: 2010-09-09
Description: A sample template
Resources:
  NeptuneDBCluster:
    Type: AWS::Neptune::DBCluster
    Properties:
      AssociatedRoles:
        - DBClusterRole
      AvailabilityZones:
        - String
      DBClusterIdentifier: String
      DBClusterParameterGroupName: String
      DBSubnetGroupName: String
      DeletionProtection: true
      EnableCloudwatchLogsExports:
        - String
      EngineVersion: String
      IamAuthEnabled: true
      KmsKeyId: String
      Port: 8182
      PreferredBackupWindow: String
      PreferredMaintenanceWindow: String
      RestoreToTime: String
      RestoreType: String
      SnapshotIdentifier: String
      SourceDBClusterIdentifier: String
      StorageEncrypted: true
      Tags:
        - Tag
      UseLatestRestorableTime: true
      VpcSecurityGroupIds:
        - String

Non-Compliant Code Examples

AWSTemplateFormatVersion: 2010-09-09
Description: A sample template
Resources:
  NeptuneDBCluster:
    Type: AWS::Neptune::DBCluster
    Properties:
      AssociatedRoles:
        - DBClusterRole
      AvailabilityZones:
        - String
      DBClusterIdentifier: String
      DBClusterParameterGroupName: String
      DBSubnetGroupName: String
      DeletionProtection: true
      EnableCloudwatchLogsExports:
        - String
      EngineVersion: String
      IamAuthEnabled: true
      KmsKeyId: String
      Port: 8182
      PreferredBackupWindow: String
      PreferredMaintenanceWindow: String
      RestoreToTime: String
      RestoreType: String
      SnapshotIdentifier: String
      SourceDBClusterIdentifier: String
      StorageEncrypted: false
      Tags:
        - Tag
      UseLatestRestorableTime: true
      VpcSecurityGroupIds:
        - String