From 65f39d3767f5d55f429e766307e4ab0aa92dd07b Mon Sep 17 00:00:00 2001
From: sebas_correa <sebastian.correa@nullplatform.io>
Date: Tue, 28 Jul 2026 15:35:11 -0300
Subject: [PATCH] fix: use a customer managed KMS key for RDS storage
 encryption

storage_encrypted = true alone falls back to the AWS-managed RDS key.
Trivy's check for aws_db_instance doesn't require an explicit
kms_key_id (unlike AVD-AWS-0079 for aws_rds_cluster, which caught this
in the Aurora module), but the same gap exists here. Add a dedicated
KMS key for parity and better key policy/rotation control.
---
 rds-postgres-server/deployment/main.tf | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/rds-postgres-server/deployment/main.tf b/rds-postgres-server/deployment/main.tf
index fea42ff..8aa289d 100644
--- a/rds-postgres-server/deployment/main.tf
+++ b/rds-postgres-server/deployment/main.tf
@@ -61,6 +61,27 @@ resource "aws_secretsmanager_secret_version" "master" {
   })
 }
 
+# ---------------------------------------------------------------------------
+# KMS key for RDS storage encryption (customer managed, for parity with the
+# Aurora module — the default AWS-managed RDS key works but isn't ours to
+# control key policy/rotation on)
+# ---------------------------------------------------------------------------
+
+resource "aws_kms_key" "rds" {
+  description         = "Customer managed key for RDS instance storage encryption (${var.instance_name})"
+  enable_key_rotation = true
+
+  tags = {
+    "managed-by" = "nullplatform"
+    "service-id" = var.service_id
+  }
+}
+
+resource "aws_kms_alias" "rds" {
+  name          = "alias/nullplatform-rds-${var.instance_name}"
+  target_key_id = aws_kms_key.rds.key_id
+}
+
 # ---------------------------------------------------------------------------
 # RDS instance
 # ---------------------------------------------------------------------------
@@ -83,6 +104,7 @@ resource "aws_db_instance" "main" {
   allocated_storage = var.allocated_storage
   storage_type      = "gp3"
   storage_encrypted = true
+  kms_key_id        = aws_kms_key.rds.arn
 
   db_name  = "postgres"
   username = "master"