SH404: Storage encryption at rest not enabled

Severity: medium · Category: security · Applies to: cloudformation, terraform

Why it matters

Unencrypted databases and volumes expose their data if a snapshot, a disk or a backup is copied or shared by mistake, and many compliance regimes require encryption.

How to fix

Set storage_encrypted = true (RDS) or encrypted = true (EBS), ideally with a KMS key.

Ignoring this rule

Skip it everywhere in devshield.yml:

ignore:
  - SH404

Or skip one line with a comment on that line or the line above:

devshield-ignore: SH404