Question

A CloudOps engineer must prove to auditors that all RDS DB instances across the company's production account have encryption at rest enabled, and must be alerted whenever a non-compliant instance is created. The solution should require minimal ongoing operational effort and provide a historical record of compliance status over time. Which approach best meets these requirements?

Accepted Answer

Enable the AWS Config managed rule 'rds-storage-encrypted' and configure an Amazon SNS notification on the rule's compliance change events.

Answer

Create a CloudTrail trail and write a CloudWatch Logs metric filter that matches CreateDBInstance events with StorageEncrypted set to false, then trigger an alarm.

Answer

Schedule an AWS Lambda function to run daily that calls DescribeDBInstances, checks the StorageEncrypted attribute, and emails a report to the audit team.

Answer

Enable Amazon GuardDuty and subscribe to findings that indicate unencrypted RDS storage, forwarding them to the security team via EventBridge.