Skip to main content

Documentation Index

Fetch the complete documentation index at: https://help.dsalta.com/llms.txt

Use this file to discover all available pages before exploring further.

Checks that AWS ECR container repositories are encrypted at rest.

​
Why This Matters

Unencrypted data at rest is vulnerable to unauthorized access if storage media is compromised, improperly decommissioned, or accessed by unauthorized personnel. Encryption at rest is a baseline requirement for SOC 2 (CC6.1), ISO 27001 (A.10.1.1), HIPAA, and PCI DSS.

​
What DSALTA Checks

DSALTA connects to your Amazon Web Services (AWS) environment using read-only API access and evaluates this configuration on every sync cycle. The test result appears in your Data Library → Tests dashboard:
  • Passing — The configuration meets requirements. No action needed.
  • Failing — The configuration does not meet requirements. Follow the remediation steps below.
  • Not configured — The integration is connected but the required service or feature has not been set up yet.
This test runs automatically every 24 hours. If you fix the underlying issue, DSALTA will detect the change on the next sync cycle and update the status to Passing. You can also trigger a manual sync from Settings → Integrations → Amazon Web Services (AWS).

​
How to Fix

If this test is failing, follow these steps to remediate:
  1. Sign in to the AWS Management Console and navigate to the relevant service (e.g., RDS, S3, EBS, DynamoDB).
  2. Select the resource that requires encryption.
  3. For new resources, enable Encryption at rest during creation and select your KMS key.
  4. For existing unencrypted resources, you typically need to create an encrypted copy and migrate:
    • RDS: Create a snapshot → Copy snapshot with encryption → Restore from encrypted snapshot.
    • EBS: Create a snapshot → Copy snapshot with encryption → Create new volume from encrypted snapshot.
    • S3: Enable default encryption on the bucket (SSE-S3 or SSE-KMS).
    • DynamoDB: Encryption is enabled by default on new tables. For existing tables, update the encryption settings.
  5. Verify encryption is active in the resource’s configuration panel.
  6. Once configured, DSALTA will detect the change on the next sync cycle and update the test status to Passing.

​
Frequently Asked Questions

This test runs automatically every 24 hours when the Amazon Web Services (AWS) integration is connected. You can trigger a manual sync at any time from the integration settings page.
A failing test generates an alert in your DSALTA dashboard. The assigned responsible role receives a notification. Remediate the issue before it affects your compliance posture.
Yes. If this test does not apply to your environment, you can mark it as Not Applicable with a justification. This exclusion is documented for auditors.
No. DSALTA uses read-only API access and never modifies, creates, or deletes resources in your environment. Remediation actions must be performed by your team directly in Amazon Web Services (AWS).