By default, Amazon RDS instances are not encrypted. This exposes the data to potential theft and unauthorized access.

"Resources": {
    "RDSDBExample": {
        "Type": "AWS::RDS::DBInstance",
        "Properties": {
            "StorageEncrypted": false,
            "DBName": "Test DB",
            "DBInstanceClass": "db.m4.large"
        }
    }
}

By default, Amazon Redshift clusters are not encrypted. This exposes the data to unauthorized access and potential theft.

Example 1: The following template defines a Redshift cluster with no encryption enabled.

"Resources": {
    "RedshiftClusterTest": {
        "Type": "AWS::Redshift::Cluster",
        "Properties": {
            "DBName": "mydb",
            "MasterUsername": "master",
            "MasterUserPassword": "masterPass",
            "NodeType": "ds2.xlarge",
            "ClusterType": "single-node",
        }
    }

By default, Amazon Redshift clusters do not require transport encryption. This exposes the data to unauthorized access, tampering, and potential theft.

Example 1: The following example template defines an Amazon Redshift cluster that does not enforce transport security.

{
    "Resources": {
        "RedShiftParms": {
            "Type": "AWS::Redshift::clusterParameterGroup",
            "Properties": {
                "Description": "parameter group",
                "ParameterGroupFamily": "redshift-1.0",
                "Parameters": [
                    {
                        "ParameterName": "require_ssl",
                        "ParameterValue": "false"
                    }
                ]
            }
        }
    }
}

An Amazon S3 bucket is created without server-side encryption. Encryption mitigates data breaches by making data unreadable to anyone without the proper credentials. As such, encryption at rest is a measure to meet some industrial and government compliance requirements such as GDPR, HIPAA, and PCI.

By default, SNS topics are not encrypted at rest. This potentially exposes the data to unauthorized viewers.

Example 1: The following example template fails to encrypt the SNS topic by neglecting to define an AWS KMS key identifier.

{
    "AWSTemplateFormatVersion": "2010-09-09",
    "Description": "My SNS topic",
    "Resources": {
        "MySNSTopic": {
            "Type": "AWS::SNS::Topic",
            "Properties": {
                "Subscription": [
                    {
                        "Endpoint": "MySNSEndpoint",
                        "Protocol": "sqs"
                    }
                ],
                "TopicName": "MyTopic"
            }
        }
    }
}

Encryption at rest is not enabled. This exposes data to unauthorized access and potential theft.

A lack of audit records limits the ability to detect and respond to security-related incidents and prevents forensic investigation.

Configuration settings that undermine logging capabilities include but are not limited to:
- deliberately disabling audit logging
- exempting actions of specific users, groups, or processes from being logged
- inadequately protecting log integrity
- not enabling optional audit logging
- reducing the log sampling rate