Database

1# Compliant fixture — private, encrypted RDS. MUST pass (POLICY_OK).
2resource "aws_db_instance" "good" {
3  identifier          = "good-db"
4  engine              = "postgres"
5  instance_class      = "db.t4g.micro"
6  allocated_storage   = 20
7  publicly_accessible = false
8  storage_encrypted   = true
9}
10
11# Variable-driven encryption must fail-open (not flagged) — proves fail-open path.
12resource "aws_rds_cluster" "var_driven" {
13  cluster_identifier = "var-db"
14  engine             = "aurora-postgresql"
15  storage_encrypted  = var.encrypt_db
16}
17
18variable "encrypt_db" {
19  type    = bool
20  default = true
21}