Description

RDS database cluster snapshots are backups for RDS clusters and can be used to restore a cluster. RDS database cluster snapshot '{AwsRdsDbClusterSnapshot}' is encrypted using the default AWS-managed KMS key (key id: '{AwsRdsDbClusterSnapshot.KmsKey.KeyId}'). Cluster snapshots should be encrypted using a customer-managed KMS key in order to enable more control over the key

• 

  Recommended Mitigation

  We recommend to encrypt RDS cluster snapshots with customer-managed KMS key, to enable more control over the keys.