Unencrypted RDS instance
A database with storage encryption off and backups barely configured.
Press Run. The stack loaded here fails in a way worth seeing.
▸What the engine finds8 findings
Not examples — Unencrypted RDS instance was run through the real engine when this page was built, and this is what it returned.
deletionProtection is off — a stack delete would take the data with it.INTENT
StorageEncrypted is false — set storageEncrypted: true.INTENT
▸ 6 informational findings — deletion protection is, database on its, storage not encrypted
Deletion protection is offAwsSolutions-RDS10Db
The RDS instance or Aurora DB cluster does not have deletion protection enabled. Enabling Deletion Protection at the cluster level for Amazon Aurora databases or instance level for non Aurora instances helps protect from accidental deletion.
Full rule text
The RDS instance or Aurora DB cluster does not have deletion protection enabled. Enabling Deletion Protection at the cluster level for Amazon Aurora databases or instance level for non Aurora instances helps protect from accidental deletion.
Database on its default portAwsSolutions-RDS11Db
The RDS instance or Aurora DB cluster uses the default endpoint port. Port obfuscation (using a non default endpoint port) adds an additional layer of defense against non-targeted attacks (i.e. MySQL/Aurora port 3306, SQL Server port 1433, PostgreSQL port 5432, etc).
Full rule text
The RDS instance or Aurora DB cluster uses the default endpoint port. Port obfuscation (using a non default endpoint port) adds an additional layer of defense against non-targeted attacks (i.e. MySQL/Aurora port 3306, SQL Server port 1433, PostgreSQL port 5432, etc).
Storage not encrypted at restAwsSolutions-RDS2Db
The RDS instance or Aurora DB cluster does not have storage encryption enabled. Storage encryption helps protect data-at-rest by encrypting the underlying storage, automated backups, read replicas, and snapshots for the database.
Full rule text
The RDS instance or Aurora DB cluster does not have storage encryption enabled. Storage encryption helps protect data-at-rest by encrypting the underlying storage, automated backups, read replicas, and snapshots for the database.
Not deployed across availability zonesAwsSolutions-RDS3Db
The non-Aurora RDS DB instance does not have multi-AZ support enabled. Use multi-AZ deployment configurations for high availability and automatic failover support fully managed by AWS.
Full rule text
The non-Aurora RDS DB instance does not have multi-AZ support enabled. Use multi-AZ deployment configurations for high availability and automatic failover support fully managed by AWS.
Secret is never rotatedAwsSolutions-SMG4Secret
The secret does not have automatic rotation scheduled. AWS Secrets Manager can be configured to automatically rotate the secret for a secured service or database.
Full rule text
The secret does not have automatic rotation scheduled. AWS Secrets Manager can be configured to automatically rotate the secret for a secured service or database.
VPC has no flow logsAwsSolutions-VPC7Vpc
With no flow logs there is no record of network traffic, so a connection you did not expect leaves no trace to find later.
Full rule text
The VPC does not have an associated Flow Log. VPC Flow Logs capture network flow information for a VPC, subnet, or network interface and stores it in Amazon CloudWatch Logs. Flow log data can help customers troubleshoot network issues; for example, to diagnose why specific traffic is not reaching an instance, which might be a result of overly restrictive security group rules. AwsSolutions-VPC7 guide →
Or start from a stack that fails interestingly
The single most common AI-generated CDK mistake: a bucket left open to the world.
SSH open to the entire internet — the classic copy-paste ingress rule.
Website hosting straight off a bucket — no CDN, no TLS, no access logging.
A database with storage encryption off and backups barely configured.
Action "*" on Resource "*" — the permission grant that ends incident reviews.
A REST API wired to Lambda, wide open, with no access logging.
Fast to write, impossible to restore — no PITR, no encryption choice.
A CDN that will happily serve your site unencrypted, with no logging.
A queue with no server-side encryption and no dead-letter queue.
Network traffic no one can reconstruct after the fact.
Six characters, no symbols, no MFA — defaults nobody revisited.
The one that passes. Encrypted, recoverable, with a dead-letter queue — what good looks like.