Confirm the cluster is unencrypted and choose the KMS key the encrypted replacement will use. Take a snapshot of the existing cluster, then copy the snapshot specifying the KMS key; the snapshot copy is where encryption is introduced. Restore a new DB cluster from the encrypted snapshot copy and cut application traffic over to it. Add a guardrail so new RDS DB clusters are always created with encryption at rest enabled from the start.

Compliance Medium severity

AWS Security Hub · RDS

RDS.27: No alerts on RDS failovers or changes

Written and reviewed by Emnode · Last reviewed 27 May 2026

What does AWS Security Hub RDS.27 check?

RDS.27 checks whether an RDS DB cluster (`AWS::RDS::DBCluster`) is encrypted at rest. The backing Config rule `rds-cluster-encrypted-at-rest` evaluates the cluster's `StorageEncrypted` property and marks the cluster NON_COMPLIANT when it is false, so the control reports FAILED for any DB cluster created without encryption.

Why does RDS.27 matter?

Data at rest is any data held in persistent, non-volatile storage, and encrypting it protects the confidentiality of both data and metadata against unauthorised access. Encrypting your RDS DB clusters fulfils data-at-rest requirements in baselines such as NIST 800-53 (SC-13, SC-28). What makes this control sharp is that encryption is fixed for the life of the cluster (there is no way to change the encryption setting after a cluster is created), so the longer an unencrypted cluster runs and the more data it accumulates, the costlier and riskier the eventual migration to an encrypted cluster becomes.

How do I fix RDS.27?

Confirm the cluster is unencrypted and choose the KMS key the encrypted replacement will use.
Take a snapshot of the existing cluster, then copy the snapshot specifying the KMS key; the snapshot copy is where encryption is introduced.
Restore a new DB cluster from the encrypted snapshot copy and cut application traffic over to it.
Add a guardrail so new RDS DB clusters are always created with encryption at rest enabled from the start.

Remediation script · bash

# One SNS topic, then one RDS subscription per source type with the required categories.
TOPIC=$(aws sns create-topic --name ops-pager --query TopicArn --output text)

aws rds create-event-subscription --subscription-name rds-instance-critical \
  --sns-topic-arn "$TOPIC" --source-type db-instance \
  --event-categories "maintenance" "configuration change" "failure" --enabled   # RDS.20

aws rds create-event-subscription --subscription-name rds-cluster-critical \
  --sns-topic-arn "$TOPIC" --source-type db-cluster \
  --event-categories "maintenance" "failure" --enabled                           # RDS.19

aws rds create-event-subscription --subscription-name rds-pg-critical \
  --sns-topic-arn "$TOPIC" --source-type db-parameter-group \
  --event-categories "configuration change" --enabled                            # RDS.21

aws rds create-event-subscription --subscription-name rds-sg-critical \
  --sns-topic-arn "$TOPIC" --source-type db-security-group \
  --event-categories "configuration change" "failure" --enabled                  # RDS.22

# S3: EventBridge is the lowest-friction destination, no per-bucket policy needed.
aws s3api put-bucket-notification-configuration --bucket acme-customer-uploads \
  --notification-configuration '{"EventBridgeConfiguration":{}}'                 # S3.11

# Then smoke-test the wire: reboot a non-prod DB and confirm the page lands.
aws rds reboot-db-instance --db-instance-identifier staging-postgres-1

Full walkthrough (console steps, edge cases and verification) in the lesson Configure event notifications and subscriptions.

Is RDS.27 a false positive?

There is no in-place toggle for this control. Teams sometimes expect a `modify-db-cluster` flag to clear the finding, but encryption at rest can only be set when the cluster is created: you must create a new encrypted cluster from an encrypted snapshot copy and migrate the data, rather than enabling encryption on the existing cluster.

Full lesson Configure event notifications and subscriptions Step-by-step remediation with CLI, code and persona-specific context.

AWS documentation for RDS controls ↗ Check your own account for RDS.27 →

Part of the learning path See what's happening

RDS.1 An RDS snapshot is shared publicly
RDS.2 An RDS instance is publicly accessible from the internet
RDS.3 RDS DB instances should be encrypted at rest
RDS.4 RDS snapshots should be encrypted at rest
RDS.5 RDS DB instances should use multiple AZs
RDS.6 RDS lacks enhanced monitoring
RDS.7 RDS clusters should have deletion protection
RDS.8 RDS DB instances should have deletion protection
RDS.9 RDS engine logs are not shipped to CloudWatch
RDS.10 RDS relies on long-lived database passwords
RDS.11 RDS instances should have automatic backups
RDS.12 IAM auth should be configured for RDS clusters