Find Unencrypted RDS Instances and Aurora Clusters

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReadDatabases",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeRegions",
        "rds:DescribeDBInstances",
        "rds:DescribeDBClusters"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ReadKeyMetadata",
      "Effect": "Allow",
      "Action": "kms:DescribeKey",
      "Resource": "arn:aws:kms:*:123456789012:key/*"
    }
  ]
}

// find-unencrypted-rds-instances.ts
// Report only. Lists RDS DB instances and Aurora / Multi-AZ DB clusters in each Region, shows whether
// storage is encrypted and with which kind of KMS key, and flags unencrypted databases and keys that
// are disabled or pending deletion.
// Usage:
//   npx tsx find-unencrypted-rds-instances.ts [--regions us-east-1,eu-west-1 | --all-regions] [--require-cmk] [--csv rds-encryption.csv]
import { writeFileSync } from "node:fs";
import { DescribeRegionsCommand, EC2Client } from "@aws-sdk/client-ec2";
import { DescribeKeyCommand, KMSClient } from "@aws-sdk/client-kms";
import { RDSClient, paginateDescribeDBClusters, paginateDescribeDBInstances } from "@aws-sdk/client-rds";

const args = process.argv.slice(2);
const flag = (name: string): string | undefined => {
  const i = args.indexOf(name);
  return i >= 0 ? args[i + 1] : undefined;
};
const requireCmk = args.includes("--require-cmk"); // also flag the AWS managed aws/rds key and AWS owned keys
const csvPath = flag("--csv");

interface Row {
  Region: string;
  Kind: string;
  Name: string;
  Engine: string;
  Created: string;
  Encryption: string;
  KeyState: string;
  Finding: string;
}

interface KeyInfo {
  manager: string; // "AWS" (aws/rds) or "CUSTOMER"
  state: string; // Enabled, Disabled, PendingDeletion, ...
}

async function regionList(): Promise<string[]> {
  const named = flag("--regions");
  if (named) return named.split(",").map((r) => r.trim()).filter(Boolean);
  if (!args.includes("--all-regions")) return [process.env.AWS_REGION ?? "us-east-1"];
  const ec2 = new EC2Client({ region: process.env.AWS_REGION ?? "us-east-1" });
  const { Regions = [] } = await ec2.send(new DescribeRegionsCommand({}));
  return Regions.map((r) => r.RegionName ?? "").filter(Boolean).sort();
}

async function scanRegion(region: string): Promise<Row[]> {
  const rds = new RDSClient({ region });
  const kms = new KMSClient({ region });
  const keys = new Map<string, KeyInfo>();

  // One DescribeKey per distinct key ARN. Needs kms:DescribeKey; without it the key shows as "unknown".
  const describeKey = async (keyId: string): Promise<KeyInfo> => {
    const cached = keys.get(keyId);
    if (cached) return cached;
    let info: KeyInfo = { manager: "unknown", state: "unknown" };
    try {
      const { KeyMetadata } = await kms.send(new DescribeKeyCommand({ KeyId: keyId }));
      info = { manager: KeyMetadata?.KeyManager ?? "unknown", state: KeyMetadata?.KeyState ?? "unknown" };
    } catch (err) {
      info = { manager: "unknown", state: err instanceof Error ? err.name : "error" };
    }
    keys.set(keyId, info);
    return info;
  };

  // Classify one database: storage encryption type first, then the key behind it.
  const classify = async (encrypted: boolean | undefined, type: string | undefined, keyId: string | undefined) => {
    if (!encrypted || type === "none") return { enc: "NONE", state: "", finding: "UNENCRYPTED" };
    if (type === "sse-rds") return { enc: "AWS owned key", state: "", finding: requireCmk ? "not a customer managed key" : "ok" };
    if (!keyId) return { enc: "encrypted (key not returned)", state: "", finding: "check manually" };
    const key = await describeKey(keyId);
    const enc = key.manager === "AWS" ? "aws/rds (AWS managed)" : key.manager === "CUSTOMER" ? "customer managed" : "unknown key";
    let finding = "ok";
    if (key.state === "Disabled" || key.state === "PendingDeletion") finding = `KEY ${key.state.toUpperCase()}`;
    else if (requireCmk && key.manager !== "CUSTOMER") finding = "not a customer managed key";
    return { enc, state: key.state, finding };
  };

  const rows: Row[] = [];
  const day = (d: Date | undefined) => (d ? d.toISOString().slice(0, 10) : "");

  // Aurora and Multi-AZ DB clusters: encryption is a cluster setting shared by every member instance.
  for await (const page of paginateDescribeDBClusters({ client: rds }, {})) {
    for (const c of page.DBClusters ?? []) {
      const r = await classify(c.StorageEncrypted, c.StorageEncryptionType, c.KmsKeyId);
      rows.push({
        Region: region,
        Kind: "cluster",
        Name: c.DBClusterIdentifier ?? "?",
        Engine: c.Engine ?? "?",
        Created: day(c.ClusterCreateTime),
        Encryption: r.enc,
        KeyState: r.state,
        Finding: r.finding,
      });
    }
  }

  // Standalone DB instances and read replicas. Cluster members are covered by the cluster row above.
  for await (const page of paginateDescribeDBInstances({ client: rds }, {})) {
    for (const db of page.DBInstances ?? []) {
      if (db.DBClusterIdentifier) continue;
      const r = await classify(db.StorageEncrypted, db.StorageEncryptionType, db.KmsKeyId);
      rows.push({
        Region: region,
        Kind: db.ReadReplicaSourceDBInstanceIdentifier ? "replica" : "instance",
        Name: db.DBInstanceIdentifier ?? "?",
        Engine: db.Engine ?? "?",
        Created: day(db.InstanceCreateTime),
        Encryption: r.enc,
        KeyState: r.state,
        Finding: r.finding,
      });
    }
  }
  return rows;
}

function toCsv(rows: Row[]): string {
  const cols = Object.keys(rows[0] ?? {}) as (keyof Row)[];
  const cell = (v: string) => `"${v.replace(/"/g, '""')}"`;
  return [cols.join(","), ...rows.map((r) => cols.map((c) => cell(r[c])).join(","))].join("\n") + "\n";
}

async function main(): Promise<void> {
  const rows: Row[] = [];
  for (const region of await regionList()) {
    try {
      rows.push(...(await scanRegion(region)));
    } catch (err) {
      console.error(`${region}: ${err instanceof Error ? `${err.name}: ${err.message}` : String(err)}`);
    }
  }
  const findings = rows.filter((r) => r.Finding !== "ok");
  console.table(findings.length ? findings : rows);
  const unencrypted = rows.filter((r) => r.Finding === "UNENCRYPTED").length;
  console.log(`${rows.length} databases checked, ${unencrypted} unencrypted, ${findings.length - unencrypted} other findings`);
  if (csvPath && rows.length) {
    writeFileSync(csvPath, toCsv(rows));
    console.log(`Wrote ${rows.length} rows to ${csvPath}`);
  }
  console.log("Report only: nothing was modified.");
}

main().catch((err) => {
  console.error(err);
  process.exit(1);
});

npm install @aws-sdk/client-rds @aws-sdk/client-kms @aws-sdk/client-ec2
npm install --save-dev tsx typescript @types/node

# Every Region, CSV for the audit ticket
AWS_PROFILE=readonly npx tsx find-unencrypted-rds-instances.ts --all-regions --csv rds-encryption.csv

# Production standard: anything not on a customer managed key is a finding
AWS_PROFILE=readonly npx tsx find-unencrypted-rds-instances.ts --regions eu-west-1 --require-cmk

┌─────────┬─────────────┬────────────┬──────────────────┬─────────────────────┬──────────────┬────────────────────┬───────────────────┬───────────────────────┐
│ (index) │ Region      │ Kind       │ Name             │ Engine              │ Created      │ Encryption         │ KeyState          │ Finding               │
├─────────┼─────────────┼────────────┼──────────────────┼─────────────────────┼──────────────┼────────────────────┼───────────────────┼───────────────────────┤
│ 0       │ 'us-east-1' │ 'instance' │ 'legacy-mysql'   │ 'mysql'             │ '2019-03-14' │ 'NONE'             │ ''                │ 'UNENCRYPTED'         │
│ 1       │ 'us-east-1' │ 'replica'  │ 'legacy-mysql-r' │ 'mysql'             │ '2021-06-02' │ 'NONE'             │ ''                │ 'UNENCRYPTED'         │
│ 2       │ 'eu-west-1' │ 'cluster'  │ 'billing-aurora' │ 'aurora-postgresql' │ '2023-10-09' │ 'customer managed' │ 'PendingDeletion' │ 'KEY PENDINGDELETION' │
└─────────┴─────────────┴────────────┴──────────────────┴─────────────────────┴──────────────┴────────────────────┴───────────────────┴───────────────────────┘
14 databases checked, 2 unencrypted, 1 other findings
Wrote 14 rows to rds-encryption.csv
Report only: nothing was modified.