RDS Restore UI Shows "Enable Encryption" Option for Unencrypted Snapshots But Doesn't Actually Enable Encryption

Question

(description and title were generated with Amazon Q, and then modified and verified as accurate by myself)

I've encountered what appears to be a UI bug or misleading interface behavior when restoring RDS instances from snapshots.

**Issue**: When restoring an RDS instance from an unencrypted snapshot, the AWS Console shows an "Enable Encryption" option that can be selected. However, after completing the restore process, the resulting database instance is not encrypted, despite having selected this option.

**Steps to Reproduce**:

1. Have an unencrypted RDS snapshot
2. Go to RDS Console → Snapshots
3. Select the unencrypted snapshot and click "Restore snapshot"
4. In the restore dialog, the "Enable Encryption" option is available and selectable
5. Select "Enable Encryption" and complete the restore
6. Check the restored instance - it shows "Encryption ... Not enabled"

**Expected Behavior**: One of the following should happen:

* The "Enable Encryption" option should be grayed out/disabled for unencrypted snapshots
* A clear error message should explain why encryption cannot be enabled
* The encryption should actually work as the UI suggests

**Actual Behavior**: The UI accepts the encryption setting but silently ignores it, creating an unencrypted instance.

**Workaround**: I've confirmed that the documented workaround works correctly:

1. * Copy the unencrypted snapshot with encryption enabled
2. * Restore from the encrypted snapshot copy This properly creates an encrypted instance.

**Environment**:

* AWS Console (latest version)
* RDS MariaDB engine
* Tested multiple times with consistent results

This UI behavior is confusing and could lead to security issues if users believe their restored databases are encrypted when they're actually not. The interface should either work as displayed or clearly indicate why the option isn't available.

Has anyone else experienced this issue? Is this a known limitation that should be better communicated in the UI?

Riku_Kobayashi · Answer

Hello.

What do you think about giving some UI-related feedback?  
You can send feedback about the UI by opening the RDS console and clicking "Feedback" in the bottom left corner of the screen.  
![a](/media/postImages/original/IM6WRsLYADTSCctYU3vQgS_g)

![a](/media/postImages/original/IMQGr3KaPCTlyh84rX2bnJIQ)

re:Post Agent · Answer

This behavior is indeed a limitation of Amazon RDS encryption functionality, though the UI could be clearer about it.

You've correctly identified that you cannot directly enable encryption when restoring from an unencrypted snapshot. According to RDS encryption limitations, you can only encrypt an RDS DB instance when you create it initially, not after it's created. Similarly, you cannot create an encrypted snapshot of an unencrypted DB instance.

The proper workflow you discovered is the correct approach:
1. Create a copy of the unencrypted snapshot with encryption enabled
2. Restore from that encrypted snapshot copy

This is the documented method to "effectively add encryption to an unencrypted DB instance." When the UI allows you to select "Enable Encryption" during the restore process but doesn't actually encrypt the resulting instance, it's not working as expected and could create a false sense of security.

The behavior is similar to other AWS database services like Amazon DocumentDB, which also only allows encryption to be enabled at creation time, not after a cluster has been created.

Your concern about this potentially leading to security issues is valid. Users might believe their restored databases are encrypted when they're not. It would be better if the UI either disabled the encryption option for unencrypted snapshots or provided a clear warning that encryption cannot be enabled during this operation and directed users to the proper workflow.

The workaround you've identified (copying the snapshot with encryption enabled first) is the correct approach and aligns with AWS documentation on how to add encryption to previously unencrypted RDS resources.  
**Sources**  
[Encrypting Amazon RDS resources - Amazon Relational Database Service](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html)  
[Encrypting Amazon DocumentDB data at rest - Amazon DocumentDB](https://docs.aws.amazon.com/documentdb/latest/developerguide/encryption-at-rest.html)

RDS Restore UI Shows "Enable Encryption" Option for Unencrypted Snapshots But Doesn't Actually Enable Encryption

Add your answer

Relevant content