---
title: RDS databases should be encrypted
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Datadog Security > OOTB Rules > RDS databases should be encrypted
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# RDS databases should be encrypted
 
## Description{% #description %}

Amazon RDS DB instances should have storage encryption enabled (`StorageEncrypted` set to `True`). Encryption at rest uses AES-256 to protect data on the instance's underlying storage, as well as its automated backups, read replicas, and snapshots. Encryption cannot be enabled on an existing unencrypted instance; it must be migrated to a new encrypted instance.

## Remediation{% #remediation %}

1. To avoid data loss, keep the database offline or read-only while you take the snapshot. Take a snapshot of the unencrypted DB instance, then [copy the snapshot](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_CopySnapshot.html) with encryption enabled (using the AWS managed key or a customer managed KMS key) and the **Copy Tags** option selected.
1. [Restore the encrypted snapshot](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_RestoreFromSnapshot.html) to a new DB instance, update applications to use the new endpoint, and delete the unencrypted instance after migration is complete.

## References{% #references %}

- [Encrypting Amazon RDS resources](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html)
- [Copying a DB snapshot](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_CopySnapshot.html)
- [Restoring to a DB instance from a snapshot](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_RestoreFromSnapshot.html)
- [CIS Amazon Web Services Benchmarks](https://www.cisecurity.org/benchmark/amazon_web_services)