Fix CRLY.01072: Encrypt RDS data at rest

[curly-review]

Issue Details

ID: CRLY.01072
Severity: HIGH
File: cfn/cfn-nipap-backend.json

---

Remediation Summary

Description

The security finding indicates that the data stored in the RDS instance is not securely encrypted at rest. This poses a risk as unencrypted data can be accessed by unauthorized users if the storage medium is compromised.

Steps

To remediate this issue, you need to add the KmsKeyId property to the Properties section of the RdsNipapDb resource in your CloudFormation template. This property specifies the KMS key that RDS will use to encrypt the data at rest.

Here's how you can update your CloudFormation template programmatically:

1. Identify the KMS Key ARN: Ensure you have the ARN of the KMS key you want to use for encryption. You can create a KMS key using the AWS CLI or SDK if you don't already have one.

2. Update the CloudFormation Template: Add the KmsKeyId property under the Properties section of the RdsNipapDb resource.

Here is an example of how to update the CloudFormation template:

"RdsNipapDb": {
    "Type": "AWS::RDS::DBInstance",
    "Properties": {
        "AllocatedStorage": "5",
        "AllowMajorVersionUpgrade": true,
        "AutoMinorVersionUpgrade": true,
        "BackupRetentionPeriod": "30",
        "DBInstanceClass": "db.t2.micro",
        "DBInstanceIdentifier": "talr-nipap",
        "DBName": "nipap",
        "DBSecurityGroups": [{
            "Ref": "SgNipapPostgres"
        }],
        "DBSubnetGroupName": {
            "Ref": "TailorNipapDbSubnetGroup"
        },
        "Engine": "postgres",
        "MasterUsername": "root",
        "MasterUserPassword": {
            "Ref": "TailorNipapDbMasterPassword"
        },
        "MultiAZ": true,
        "StorageType": "gp2",
        "Tags": [{
            "Key": "Name",
            "Value": "Tailor NIPAP"
        }, {
            "Key": "stack",
            "Value": {
                "Ref": "EnvironmentName"
            }
        }, {
            "Key": "app",
            "Value": {
                "Ref": "AppName"
            }
        }, {
            "Key": "purpose",
            "Value": "DB backend for NIPAP IPAM tool"
        }],
        "KmsKeyId": "arn:aws:kms:us-west-2:123456789012:key/abcd1234-a123-456a-a12b-a123b4cd56ef"  # Add your KMS Key ARN here
    },
    "DeletionPolicy": "Snapshot"
}

Replace arn:aws:kms:us-west-2:123456789012:key/abcd1234-a123-456a-a12b-a123b4cd56ef with the actual ARN of your KMS key.

3. Deploy the Updated Template: After updating the template, deploy the CloudFormation stack using the AWS CLI or SDK.

aws cloudformation deploy --template-file cfn/cfn-nipap-backend.json --stack-name nipap-backend --capabilities CAPABILITY_NAMED_IAM

By following these steps, you will ensure that all data stored in the RDS instance is securely encrypted at rest.