RDS instance certificate has over 3 months validity left

Check ID: rds_instance_certificate_expiration
Provider: AWS
Service: rds
Severity: HIGH
Categories: encryption
Resource type: AwsRdsDbInstance

What this check verifies

RDS DB instances are evaluated for server certificate validity windows, including default and customer-managed certificates. Certificates expired or approaching expiration (e.g., <1 month, <3 months, 3-6 months, >6 months) are identified using the certificate valid_till date.

Risk

Without timely rotation:

TLS failures block DB connections, impacting availability
Bypassed or weak validation enables MITM, risking confidentiality and integrity
Emergency changes increase operational risk and error rates

Recommendation

Establish a certificate lifecycle for RDS:

Rotate server/CA certs well before expiry; avoid pinned or outdated CAs
Keep client trust stores current and enforce TLS with validation
Monitor expiry and automate alerts/rotation
For custom certs, apply least privilege, separation of duties, and periodic key rotation; test changes

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws rds modify-db-instance —db-instance-identifier <example_resource_id> —ca-certificate-identifier rds-ca-rsa2048-g1 —apply-immediately

# Set a current CA on the RDS instance
resource "aws_db_instance" "<example_resource_name>" {
  identifier          = "<example_resource_id>"
  ca_cert_identifier  = "rds-ca-rsa2048-g1"  # CRITICAL: rotates to a valid CA to ensure certificate validity >3 months
}

# CloudFormation: update RDS instance CA to a current certificate
Resources:
  <example_resource_name>:
    Type: AWS::RDS::DBInstance
    Properties:
      CACertificateIdentifier: rds-ca-rsa2048-g1  # CRITICAL: rotates to a valid CA to restore >3 months certificate validity

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = rds_instance_certificate_expiration. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

RDS instance has backup retention period greater than 0 days RDS DB instance has copy tags to snapshots enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires