<p>Either use the <code>--query</code> attribute</p>

<pre><code>aws rds describe-db-snapshots --query "DBSnapshots[?Encrypted].DBSnapshotIdentifier"
</code></pre>

<p>If the <code>[?Encrypted]</code> does not work, try <code>[?Encrypted == 'true']</code> as the first is from JMESPath improved filters. The quotes might need to be backticks in some case. It all depends.</p>

<p>Second way:</p>

<pre><code>aws rds describe-db-snapshots --output json | jq '.DBSnapshots | map(select(has("Encrypted"))) | .[].DBSnapshotIndetifier'
</code></pre>

<p>One of them should work. Might need a bit messing around as I don't have your output to tune the <code>jq</code> command. Feel free to edit and fix the answer.</p>

CC BY-SA 3.0
2017-12-31T21:38:10.500Z
2018-01-13T16:33:39.330Z
2018-01-13T16:33:39.330Z
Jiri Klouda
<p>You will require a <strong>script</strong> that interacts with the <strong>AWS cli</strong> to accomplish your goal.</p>

<p>To list encrypted drives I use the following query when describing the DB snapshots <code>--query 'DBSnapshots[*].[DBSnapshotArn,Encrypted]'</code></p>

<p>I have put together the following script which will <strong>look for all encrypted DBS snapshots and then copy all of them to a different region</strong>. It can also be modified to copy unencrypted snapshots to a different region and then encrypt them.</p>

<blockquote>
  <p>I have explained the script in the comments. It is quite <strong>dirty</strong>...
  so feel free to <strong>improve</strong> it!</p>
</blockquote>

<pre><code>#!/usr/bin/env bash
#
# Copy encrypted or unencrypted DBSnapshots to an encrypted DBSnapshot in a different region
#

aws_profile="" 
aws_source_region="" 
aws_dest_region="" 
aws_kms_key_id="" #destination kms key ID 
num=1

aws --profile "${aws_profile}" --region "${aws_source_region}" rds describe-db-snapshots \
  --query 'DBSnapshots[*].[DBSnapshotArn,Encrypted]' \  
  --output text &gt; rds-snapshots-list.txt

echo "Encrypted snapshots" 
awk '{IGNORECASE=1}{if ($2 == "True") print}' rds-snapshots-list.txt #Show list of encrypted snapshots 
echo "Unencrypted snapshots" 
awk '{IGNORECASE=1}{if ($2 == "False") print}' rds-snapshots-list.txt #Show list of unencrypted snapshots

IFS=$'\n' read -d '' -r -a rds_list_lines &lt; rds-snapshots-list.txt #Move txt file content into an array

echo "Copying encrypted snapshots from ${aws_source_region} to ${aws_dest_region}" 
for i in "${rds_list_lines[@]}"; do #Loop through array   
if [[ "${i}" == *"True"* ]]; then #Check for encrypted rds snapshot &amp; if true copy snapshot
    source_snapshot_ident="$( echo "${i}" | sed 's/[[:blank:]]True.*//')" #Remove all spaces tabs and the word true
    target_snapshot_ident="$( echo "$source_snapshot_ident" | sed 's/.*:snapshot:rds:.//')snapshotcopy$num" #Name of target snapshot with incrementing number
    ((num++))

    aws --profile "${aws_profile}" --region "${aws_dest_region}" rds copy-db-snapshot \
      --source-db-snapshot-identifier "${source_snapshot_ident}" \
      --target-db-snapshot-identifier "${target_snapshot_ident}" \
      --source-region "${aws_source_region}" \
      --kms-key-id "${aws_kms_key_id}"   
fi 
done
</code></pre>

CC BY-SA 3.0
2018-01-06T10:11:04.803Z
2018-01-16T07:03:29.483Z
2018-01-16T07:03:29.483Z
Kyle Steenkamp
<p>I have automated the RDS snapshot copy across the region, but the Snapshot which is encrypted gets fail to copy.
I have figured a way to copy an encrypted snapshot using </p>

<pre><code>$  aws rds copy-db-snapshot   --source-db-snapshot-identifier arn:aws:rds:eu-west-1:XXXX:snapshot:XXX-2017-01-31-04-30      --target-db-snapshot-identifier mydbsnapshotcopy   --kms-key-id XXX --region eu-central-1 --source-region eu-west-1
</code></pre>

<p>I want to filter/test the snapshots if they are encrypted or not, if they are encrypted I will perform the above-defined operation.
I tried this which is not working. </p>

<pre><code>$ aws rds describe-db-snapshots  --filter "Name=encrypted,Values=true"
</code></pre>

<p>How do I list/filter all the encrypted snapshots and move it to a file?</p>

<amazon-web-services><aws-cli><amazon-rds>
List encrypted RDS snapshots using CLI
Nirbhay Singh
# List encrypted RDS snapshots using CLI

(Asked by: username_0 on 2017-12-11)

I have automated the RDS snapshot copy across the region, but the Snapshot which is encrypted gets fail to copy.
I have figured a way to copy an encrypted snapshot using 
$  aws rds copy-db-snapshot   --source-db-snapshot-identifier arn:aws:rds:eu-west-1:XXXX:snapshot:XXX-2017-01-31-04-30      --target-db-snapshot-identifier mydbsnapshotcopy   --kms-key-id XXX --region eu-central-1 --source-region eu-west-1

I want to filter/test the snapshots if they are encrypted or not, if they are encrypted I will perform the above-defined operation.
I tried this which is not working. 
$ aws rds describe-db-snapshots  --filter "Name=encrypted,Values=true"

How do I list/filter all the encrypted snapshots and move it to a file?

**Tags:** amazon-web-services, aws-cli, amazon-rds


---

## 2 answers

### Answer by username_1 on 2017-12-31. Score: 3

Either use the --query attribute
aws rds describe-db-snapshots --query "DBSnapshots[?Encrypted].DBSnapshotIdentifier"

If the [?Encrypted] does not work, try [?Encrypted == 'true'] as the first is from JMESPath improved filters. The quotes might need to be backticks in some case. It all depends.
Second way:
aws rds describe-db-snapshots --output json | jq '.DBSnapshots | map(select(has("Encrypted"))) | .[].DBSnapshotIndetifier'

One of them should work. Might need a bit messing around as I don't have your output to tune the jq command. Feel free to edit and fix the answer.


---

### Answer by username_2 on 2018-01-06. Score: 1

You will require a script that interacts with the AWS cli to accomplish your goal.
To list encrypted drives I use the following query when describing the DB snapshots --query 'DBSnapshots[*].[DBSnapshotArn,Encrypted]'
I have put together the following script which will look for all encrypted DBS snapshots and then copy all of them to a different region. It can also be modified to copy unencrypted snapshots to a different region and then encrypt them.

I have explained the script in the comments. It is quite dirty...
  so feel free to improve it!

#!/usr/bin/env bash
#
# Copy encrypted or unencrypted DBSnapshots to an encrypted DBSnapshot in a different region
#

aws_profile="" 
aws_source_region="" 
aws_dest_region="" 
aws_kms_key_id="" #destination kms key ID 
num=1

aws --profile "${aws_profile}" --region "${aws_source_region}" rds describe-db-snapshots \
  --query 'DBSnapshots[*].[DBSnapshotArn,Encrypted]' \  
  --output text > rds-snapshots-list.txt

echo "Encrypted snapshots" 
awk '{IGNORECASE=1}{if ($2 == "True") print}' rds-snapshots-list.txt #Show list of encrypted snapshots 
echo "Unencrypted snapshots" 
awk '{IGNORECASE=1}{if ($2 == "False") print}' rds-snapshots-list.txt #Show list of unencrypted snapshots

IFS=$'\n' read -d '' -r -a rds_list_lines < rds-snapshots-list.txt #Move txt file content into an array

echo "Copying encrypted snapshots from ${aws_source_region} to ${aws_dest_region}" 
for i in "${rds_list_lines[@]}"; do #Loop through array   
if [[ "${i}" == *"True"* ]]; then #Check for encrypted rds snapshot & if true copy snapshot
    source_snapshot_ident="$( echo "${i}" | sed 's/[[:blank:]]True.*//')" #Remove all spaces tabs and the word true
    target_snapshot_ident="$( echo "$source_snapshot_ident" | sed 's/.*:snapshot:rds:.//')snapshotcopy$num" #Name of target snapshot with incrementing number
    ((num++))

    aws --profile "${aws_profile}" --region "${aws_dest_region}" rds copy-db-snapshot \
      --source-db-snapshot-identifier "${source_snapshot_ident}" \
      --target-db-snapshot-identifier "${target_snapshot_ident}" \
      --source-region "${aws_source_region}" \
      --kms-key-id "${aws_kms_key_id}"   
fi 
done


---

