diff --git a/internal/adapters/cloud/aws/rds/rds.go b/internal/adapters/cloud/aws/rds/rds.go
index c3e48964a..1339caa8e 100644
--- a/internal/adapters/cloud/aws/rds/rds.go
+++ b/internal/adapters/cloud/aws/rds/rds.go
@@ -336,10 +336,15 @@ func (a *adapter) adaptDBSnapshots(dbSnapshots types.DBSnapshot) (*rds.Snapshots
 		DBSnapshotIdentifier: defsecTypes.String(*dbSnapshots.DBSnapshotIdentifier, metadata),
 		DBSnapshotArn:        defsecTypes.String(*dbSnapshots.DBSnapshotArn, metadata),
 		Encrypted:            defsecTypes.Bool(dbSnapshots.Encrypted, metadata),
-		KmsKeyId:             defsecTypes.String(*dbSnapshots.KmsKeyId, metadata),
+		KmsKeyId:             defsecTypes.String("", metadata),
 		SnapshotAttributes:   SnapshotAttributes,
 	}
 
+	// KMSKeyID is only set if Encryption is enabled
+	if snapshots.Encrypted.IsTrue() {
+		snapshots.KmsKeyId = defsecTypes.StringDefault(*dbSnapshots.KmsKeyId, metadata)
+	}
+
 	return snapshots, nil
 }