Check ID: rds_instance_transport_encrypted
Provider: AWS
Service: rds
Severity: HIGH
Categories: encryption
Resource type: AwsRdsDbInstance
What this check verifies
RDS DB instances and DB clusters enforce SSL/TLS for client connections via parameter groups. The check looks for rds.force_ssl=1 (PostgreSQL, SQL Server) or require_secure_transport enabled (MySQL-family) and identifies databases where encryption enforcement isn’t active.
Risk
Without enforced TLS, clients can connect or downgrade to plaintext, exposing credentials and queries to interception. Adversaries can perform MITM, steal secrets, and tamper traffic, undermining confidentiality and integrity and enabling reuse of captured database credentials.
Recommendation
Enforce transport encryption at the database layer:
- Enable
rds.force_ssl=1 or require_secure_transport in parameter groups
- Configure clients to require certificate validation and prevent fallback
- Use current TLS versions and trusted CAs
- Prefer private network access as defense in depth
CLI
Terraform
Native IaC
Dashboard steps
aws rds modify-db-parameter-group --region <REGION_NAME> --db-parameter-group-name <PARAMETER_GROUP_NAME> --parameters ParameterName='rds.force_ssl',ParameterValue='1',ApplyMethod='pending-reboot'
# DB instances
resource "aws_db_parameter_group" "example_pg" {
name = "<example_resource_name>"
family = "<DB_PARAMETER_FAMILY>"
parameter {
name = "rds.force_ssl"
value = "1" # Critical: requires SSL/TLS for PostgreSQL/SQL Server instances
}
}
resource "aws_db_parameter_group" "example_mysql" {
name = "<example_resource_name>"
family = "<DB_PARAMETER_FAMILY>"
parameter {
name = "require_secure_transport"
value = "1" # Critical: requires SSL/TLS for MySQL/MariaDB instances
}
}
# Aurora clusters
resource "aws_rds_cluster_parameter_group" "example_aurora_pg" {
name = "<example_resource_name>"
family = "<DB_CLUSTER_PARAMETER_FAMILY>"
parameter {
name = "rds.force_ssl"
value = "1" # Critical: requires SSL/TLS for Aurora PostgreSQL clusters
}
}
resource "aws_rds_cluster_parameter_group" "example_aurora_mysql" {
name = "<example_resource_name>"
family = "<DB_CLUSTER_PARAMETER_FAMILY>"
parameter {
name = "require_secure_transport"
value = "ON" # Critical: requires SSL/TLS for Aurora MySQL clusters
}
}
# CloudFormation: set required parameter to enforce SSL/TLS
Resources:
ExampleDBParameterGroupPostgres:
Type: AWS::RDS::DBParameterGroup
Properties:
Family: <DB_PARAMETER_FAMILY>
Description: Enforce SSL/TLS
Parameters:
rds.force_ssl: "1" # Critical: requires SSL/TLS for PostgreSQL/SQL Server instances
ExampleDBParameterGroupMySQL:
Type: AWS::RDS::DBParameterGroup
Properties:
Family: <DB_PARAMETER_FAMILY>
Description: Enforce SSL/TLS
Parameters:
require_secure_transport: "1" # Critical: requires SSL/TLS for MySQL/MariaDB instances
ExampleDBClusterParameterGroupAuroraPostgres:
Type: AWS::RDS::DBClusterParameterGroup
Properties:
Family: <DB_CLUSTER_PARAMETER_FAMILY>
Description: Enforce SSL/TLS
Parameters:
rds.force_ssl: "1" # Critical: requires SSL/TLS for Aurora PostgreSQL clusters
ExampleDBClusterParameterGroupAuroraMySQL:
Type: AWS::RDS::DBClusterParameterGroup
Properties:
Family: <DB_CLUSTER_PARAMETER_FAMILY>
Description: Enforce SSL/TLS
Parameters:
require_secure_transport: ON # Critical: requires SSL/TLS for Aurora MySQL clusters
- In the AWS Console, go to RDS > Parameter groups
- For DB instances:
- Edit the DB parameter group attached to the instance (or create one and attach it)
- Set rds.force_ssl = 1 for PostgreSQL/SQL Server, or require_secure_transport = 1 for MySQL/MariaDB
- Save. If the parameter is static, reboot the instance
- For Aurora clusters:
- Edit the DB cluster parameter group attached to the cluster (or create one and attach it)
- Set rds.force_ssl = 1 for Aurora PostgreSQL, or require_secure_transport = ON for Aurora MySQL
- Save. Reboot instances if changes are pending-reboot
- Verify the parameter group is associated to the target instance/cluster and status shows the new value applied
References
Where this check fires
This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = rds_instance_transport_encrypted. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks
