Evaluates whether disk encryption is enabled for ApsaraDB RDS instances. An instance with disk encryption enabled is evaluated as Compliant.
Scenarios
Alibaba Cloud provides a free disk encryption feature for ApsaraDB RDS instances. Disk encryption uses block storage-level encryption to protect the entire data disk, ensuring that backup data remains unreadable even if leaked.
Risk level
Default risk level: medium.
You can change the risk level when you apply this rule.
Compliance evaluation logic
- If disk encryption is enabled for an ApsaraDB RDS instance, the evaluation result is Compliant.
- If disk encryption is disabled for an ApsaraDB RDS instance, the evaluation result is Incompliant. To remediate this, seeIncompliance remediation.
Rule details
| Item | Description |
| Rule name | rds-instance-enabled-disk-encryption |
| Rule identifier | rds-instance-enabled-disk-encryption |
| Tag | RDS |
| Automatic remediation | Not supported |
| Trigger type | Periodic execution |
| Evaluation frequency | Interval of 24 hours |
| Supported resource type | ApsaraDB RDS instance |
| Input parameter | None. |
Incompliance remediation
Enable disk encryption for the ApsaraDB RDS instance. For more information, seeDisk encryption.