Answers: <p>Either use the <code>--query</code> attribute</p>
  
  <pre><code>aws rds describe-db-snapshots --query "DBSnapshots[?Encrypted].DBSnapshotIdentifier"
  </code></pre>
  
  <p>If the <code>[?Encrypted]</code> does not work, try <code>[?Encrypted == 'true']</code> as the first is from JMESPath improved filters. The quotes might need to be backticks in some case. It all depends.</p>
  
  <p>Second way:</p>
  
  <pre><code>aws rds describe-db-snapshots --output json | jq '.DBSnapshots | map(select(has("Encrypted"))) | .[].DBSnapshotIndetifier'
  </code></pre>
  
  <p>One of them should work. Might need a bit messing around as I don't have your output to tune the <code>jq</code> command. Feel free to edit and fix the answer.</p>
  
Answers: CC BY-SA 3.0
Answers: 2017-12-31T21:38:10.500Z
Answers: 2018-01-13T16:33:39.330Z
Answers: 2018-01-13T16:33:39.330Z
Answers: Jiri Klouda
Answers: <p>You will require a <strong>script</strong> that interacts with the <strong>AWS cli</strong> to accomplish your goal.</p>
  
  <p>To list encrypted drives I use the following query when describing the DB snapshots <code>--query 'DBSnapshots[*].[DBSnapshotArn,Encrypted]'</code></p>
  
  <p>I have put together the following script which will <strong>look for all encrypted DBS snapshots and then copy all of them to a different region</strong>. It can also be modified to copy unencrypted snapshots to a different region and then encrypt them.</p>
  
  <blockquote>
    <p>I have explained the script in the comments. It is quite <strong>dirty</strong>...
    so feel free to <strong>improve</strong> it!</p>
  </blockquote>
  
  <pre><code>#!/usr/bin/env bash
  #
  # Copy encrypted or unencrypted DBSnapshots to an encrypted DBSnapshot in a different region
  #
  
  aws_profile="" 
  aws_source_region="" 
  aws_dest_region="" 
  aws_kms_key_id="" #destination kms key ID 
  num=1
  
  aws --profile "${aws_profile}" --region "${aws_source_region}" rds describe-db-snapshots \
    --query 'DBSnapshots[*].[DBSnapshotArn,Encrypted]' \  
    --output text &gt; rds-snapshots-list.txt
  
  echo "Encrypted snapshots" 
  awk '{IGNORECASE=1}{if ($2 == "True") print}' rds-snapshots-list.txt #Show list of encrypted snapshots 
  echo "Unencrypted snapshots" 
  awk '{IGNORECASE=1}{if ($2 == "False") print}' rds-snapshots-list.txt #Show list of unencrypted snapshots
  
  IFS=$'\n' read -d '' -r -a rds_list_lines &lt; rds-snapshots-list.txt #Move txt file content into an array
  
  echo "Copying encrypted snapshots from ${aws_source_region} to ${aws_dest_region}" 
  for i in "${rds_list_lines[@]}"; do #Loop through array   
  if [[ "${i}" == *"True"* ]]; then #Check for encrypted rds snapshot &amp; if true copy snapshot
      source_snapshot_ident="$( echo "${i}" | sed 's/[[:blank:]]True.*//')" #Remove all spaces tabs and the word true
      target_snapshot_ident="$( echo "$source_snapshot_ident" | sed 's/.*:snapshot:rds:.//')snapshotcopy$num" #Name of target snapshot with incrementing number
      ((num++))
  
      aws --profile "${aws_profile}" --region "${aws_dest_region}" rds copy-db-snapshot \
        --source-db-snapshot-identifier "${source_snapshot_ident}" \
        --target-db-snapshot-identifier "${target_snapshot_ident}" \
        --source-region "${aws_source_region}" \
        --kms-key-id "${aws_kms_key_id}"   
  fi 
  done
  </code></pre>
  
Answers: CC BY-SA 3.0
Answers: 2018-01-06T10:11:04.803Z
Answers: 2018-01-16T07:03:29.483Z
Answers: 2018-01-16T07:03:29.483Z
Answers: Kyle Steenkamp
Body: <p>I have automated the RDS snapshot copy across the region, but the Snapshot which is encrypted gets fail to copy.
  I have figured a way to copy an encrypted snapshot using </p>
  
  <pre><code>$  aws rds copy-db-snapshot   --source-db-snapshot-identifier arn:aws:rds:eu-west-1:XXXX:snapshot:XXX-2017-01-31-04-30      --target-db-snapshot-identifier mydbsnapshotcopy   --kms-key-id XXX --region eu-central-1 --source-region eu-west-1
  </code></pre>
  
  <p>I want to filter/test the snapshots if they are encrypted or not, if they are encrypted I will perform the above-defined operation.
  I tried this which is not working. </p>
  
  <pre><code>$ aws rds describe-db-snapshots  --filter "Name=encrypted,Values=true"
  </code></pre>
  
  <p>How do I list/filter all the encrypted snapshots and move it to a file?</p>
  
Tags: <amazon-web-services><aws-cli><amazon-rds>
Title: List encrypted RDS snapshots using CLI
UserDisplayName: Nirbhay Singh
ThreadText: # List encrypted RDS snapshots using CLI
  
  (Asked by: username_0 on 2017-12-11)
  
  I have automated the RDS snapshot copy across the region, but the Snapshot which is encrypted gets fail to copy.
  I have figured a way to copy an encrypted snapshot using
  
  ```
  $  aws rds copy-db-snapshot   --source-db-snapshot-identifier arn:aws:rds:eu-west-1:XXXX:snapshot:XXX-2017-01-31-04-30      --target-db-snapshot-identifier mydbsnapshotcopy   --kms-key-id XXX --region eu-central-1 --source-region eu-west-1
  
  ```
  
  I want to filter/test the snapshots if they are encrypted or not, if they are encrypted I will perform the above-defined operation.
  I tried this which is not working.
  
  ```
  $ aws rds describe-db-snapshots  --filter "Name=encrypted,Values=true"
  
  ```
  
  How do I list/filter all the encrypted snapshots and move it to a file?
  
  **Tags:** amazon-web-services, aws-cli, amazon-rds
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2017-12-31. Score: 3
  
  Either use the `--query` attribute
  
  ```
  aws rds describe-db-snapshots --query "DBSnapshots[?Encrypted].DBSnapshotIdentifier"
  
  ```
  
  If the `[?Encrypted]` does not work, try `[?Encrypted == 'true']` as the first is from JMESPath improved filters. The quotes might need to be backticks in some case. It all depends.
  
  Second way:
  
  ```
  aws rds describe-db-snapshots --output json | jq '.DBSnapshots | map(select(has("Encrypted"))) | .[].DBSnapshotIndetifier'
  
  ```
  
  One of them should work. Might need a bit messing around as I don't have your output to tune the `jq` command. Feel free to edit and fix the answer.
  
  
  ---
  
  ### Answer by username_2 on 2018-01-06. Score: 1
  
  You will require a **script** that interacts with the **AWS cli** to accomplish your goal.
  
  To list encrypted drives I use the following query when describing the DB snapshots `--query 'DBSnapshots[*].[DBSnapshotArn,Encrypted]'`
  
  I have put together the following script which will **look for all encrypted DBS snapshots and then copy all of them to a different region**. It can also be modified to copy unencrypted snapshots to a different region and then encrypt them.
  
  > I have explained the script in the comments. It is quite **dirty**...
  > so feel free to **improve** it!
  
  ```
  #!/usr/bin/env bash
  #
  # Copy encrypted or unencrypted DBSnapshots to an encrypted DBSnapshot in a different region
  #
  
  aws_profile="" 
  aws_source_region="" 
  aws_dest_region="" 
  aws_kms_key_id="" #destination kms key ID 
  num=1
  
  aws --profile "${aws_profile}" --region "${aws_source_region}" rds describe-db-snapshots \
    --query 'DBSnapshots[*].[DBSnapshotArn,Encrypted]' \  
    --output text > rds-snapshots-list.txt
  
  echo "Encrypted snapshots" 
  awk '{IGNORECASE=1}{if ($2 == "True") print}' rds-snapshots-list.txt #Show list of encrypted snapshots 
  echo "Unencrypted snapshots" 
  awk '{IGNORECASE=1}{if ($2 == "False") print}' rds-snapshots-list.txt #Show list of unencrypted snapshots
  
  IFS=$'\n' read -d '' -r -a rds_list_lines < rds-snapshots-list.txt #Move txt file content into an array
  
  echo "Copying encrypted snapshots from ${aws_source_region} to ${aws_dest_region}" 
  for i in "${rds_list_lines[@]}"; do #Loop through array   
  if [[ "${i}" == *"True"* ]]; then #Check for encrypted rds snapshot & if true copy snapshot
      source_snapshot_ident="$( echo "${i}" | sed 's/[[:blank:]]True.*//')" #Remove all spaces tabs and the word true
      target_snapshot_ident="$( echo "$source_snapshot_ident" | sed 's/.*:snapshot:rds:.//')snapshotcopy$num" #Name of target snapshot with incrementing number
      ((num++))
  
      aws --profile "${aws_profile}" --region "${aws_dest_region}" rds copy-db-snapshot \
        --source-db-snapshot-identifier "${source_snapshot_ident}" \
        --target-db-snapshot-identifier "${target_snapshot_ident}" \
        --source-region "${aws_source_region}" \
        --kms-key-id "${aws_kms_key_id}"   
  fi 
  done
  
  ```
  
  
  ---
  
  