For AI agents: A markdown version of this page is available at https://docs.datadoghq.com/security/code_security/iac_security/iac_rules/terraform-alicloud-rds-instance-tde-status-disabled.md. A documentation index is available at /llms.txt.

RDS instance TDE status disabled

This product is not supported for your selected Datadog site. ().

Metadata

Id: terraform-alicloud-rds-instance-tde-status-disabled

Provider: Alicloud

Platform: Terraform

Severity: High

Category: Encryption

Learn More

Description

The tde_status parameter should be set to Enabled for supported RDS instances. This rule applies to alicloud_db_instance resources with engine set to MySQL (versions 5.6, 5.7, 8) or SQLServer (versions 08r2_ent_ha, 2012_ent_ha, 2016_ent_ha, 2017_ent, 2019_std_ha, 2019_ent). It flags instances where tde_status is missing or set to Disabled. Set tde_status = "Enabled" to enforce Transparent Data Encryption (TDE).

Compliant Code Examples

resource "alicloud_db_instance" "default" {
    engine = "MySQL"
    engine_version = "5.6"
    db_instance_class = "rds.mysql.t1.small"
    db_instance_storage = "10"
    tde_status = "Enabled"
    parameters = [{
        name = "innodb_large_prefix"
        value = "ON"
    },{
        name = "connect_timeout"
        value = "50"
    }]
}

resource "alicloud_db_instance" "default" {
    engine = "MySQL"
    engine_version = "8"
    db_instance_class = "rds.mysql.t1.small"
    db_instance_storage = "10"
    tde_status = "Enabled"
    parameters = [{
        name = "innodb_large_prefix"
        value = "ON"
    },{
        name = "connect_timeout"
        value = "50"
    }]
}

resource "alicloud_db_instance" "default" {
    engine = "SQLServer"
    engine_version = "2019_std_ha"
    db_instance_class = "rds.mysql.t1.small"
    db_instance_storage = "10"
    tde_status = "Enabled"
    parameters = []
}

Non-Compliant Code Examples

resource "alicloud_db_instance" "default" {
    engine = "MySQL"
    engine_version = "5.6"
    db_instance_class = "rds.mysql.t1.small"
    db_instance_storage = "10"
    tde_status = "Disabled"
    parameters = [{
        name = "innodb_large_prefix"
        value = "ON"
    },{
        name = "connect_timeout"
        value = "50"
    }]
}

resource "alicloud_db_instance" "default" {
    engine = "MySQL"
    engine_version = "8"
    db_instance_class = "rds.mysql.t1.small"
    db_instance_storage = "10"
    parameters = [{
        name = "innodb_large_prefix"
        value = "ON"
    },{
        name = "connect_timeout"
        value = "50"
    }]
}

resource "alicloud_db_instance" "default" {
    engine = "SQLServer"
    engine_version = "2019_std_ha"
    db_instance_class = "rds.mysql.t1.small"
    db_instance_storage = "10"
    tde_status = "Disabled"
    parameters = []
}