Skip to main content

RDS Transport Encryption Remediation

Triage and Remediation​

Remediation​

Using Console

To remediate the misconfiguration of enabling transport encryption for AWS RDS using the AWS console, follow these steps:

  1. Login to AWS Console: Go to the AWS Management Console and log in using your credentials.

  2. Navigate to RDS Service: Click on the "Services" dropdown menu at the top of the page, search for "RDS" and click on it to open the RDS dashboard.

  3. Select the RDS Instance: From the list of RDS instances, select the instance for which you want to enable transport encryption by clicking on its name.

  4. Modify the RDS Instance: In the RDS instance dashboard, click on the "Modify" button at the top right corner.

  5. Enable Encryption: Scroll down to the "Network & Security" section, and look for the "Encryption" option.

  6. Enable Encryption: Check the box next to "Enable Encryption" to enable transport encryption for the RDS instance.

  7. Choose Encryption Type: Select the desired encryption type (e.g., AWS Key Management Service (KMS) key) from the dropdown menu.

  8. Save Changes: Scroll down to the bottom of the page and click on the "Continue" button.

  9. Apply Changes: Review the changes you are about to make, and click on the "Modify DB Instance" button to apply the changes.

  10. Monitor Encryption Status: Once the modification is complete, monitor the RDS instance to ensure that transport encryption is successfully enabled. You can check the status in the RDS dashboard.

By following these steps, you can remediate the misconfiguration of enabling transport encryption for an AWS RDS instance using the AWS console.

Using CLI

To remediate the misconfiguration of enabling Transport Encryption for an AWS RDS instance using the AWS CLI, follow these steps:

  1. Get the RDS instance identifier: First, identify the RDS instance for which you want to enable Transport Encryption. You can get the instance identifier by running the following AWS CLI command:
aws rds describe-db-instances --query 'DBInstances[*].[DBInstanceIdentifier]' --output text
  1. Enable Transport Encryption: Once you have the RDS instance identifier, you can enable Transport Encryption by modifying the instance with the following AWS CLI command. Replace <instance_identifier> with the actual identifier of your RDS instance:
aws rds modify-db-instance --db-instance-identifier <instance_identifier> --storage-encrypted --apply-immediately
  1. Verify Encryption Status: You can verify that Transport Encryption has been enabled for the RDS instance by describing the instance and checking the StorageEncrypted attribute. Run the following AWS CLI command:
aws rds describe-db-instances --db-instance-identifier <instance_identifier> --query 'DBInstances[*].[DBInstanceIdentifier,StorageEncrypted]' --output table
  1. Wait for the Modification to Complete: The modification to enable Transport Encryption may take some time to complete. You can monitor the status of the modification by describing the RDS instance and checking the DBInstanceStatus attribute. Run the following AWS CLI command:
aws rds describe-db-instances --db-instance-identifier <instance_identifier> --query 'DBInstances[*].[DBInstanceIdentifier,DBInstanceStatus]' --output table

By following these steps, you can successfully remediate the misconfiguration of enabling Transport Encryption for an AWS RDS instance using the AWS CLI.

Using Python

To remediate the misconfiguration of enabling transport encryption for AWS RDS using Python, you can follow these steps:

  1. Import the necessary libraries:
import boto3
  1. Create an AWS RDS client:
rds = boto3.client('rds', region_name='your_region')
  1. Get a list of all RDS instances:
response = rds.describe_db_instances()
  1. Iterate through each RDS instance and enable transport encryption:
for db_instance in response['DBInstances']:
    db_instance_identifier = db_instance['DBInstanceIdentifier']
    rds.modify_db_instance(
        DBInstanceIdentifier=db_instance_identifier,
        ApplyImmediately=True,
        EnableEncryption=True
    )
  1. Confirm that the transport encryption is enabled by checking the DB instance details:
response = rds.describe_db_instances(DBInstanceIdentifier=db_instance_identifier)
if response['DBInstances'][0]['StorageEncrypted']:
    print(f"Transport encryption is enabled for RDS instance {db_instance_identifier}")
else:
    print(f"Failed to enable transport encryption for RDS instance {db_instance_identifier}")
  1. Run the Python script to enable transport encryption for all RDS instances.

Please make sure to replace 'your_region' with the appropriate AWS region where your RDS instances are located. Also, ensure that your AWS credentials are properly configured to allow the Python script to interact with AWS services.

Using Terraform
# DB cluster parameter group for a PostgreSQL-based RDS/Aurora cluster
resource "aws_rds_cluster_parameter_group" "POSTGRES_CLUSTER_PG" {
  name        = "POSTGRES_CLUSTER_PG_NAME"        # replace with your parameter group name
  family      = "aurora-postgresql15"             # replace with the correct family, e.g. postgres13, aurora-postgresql14
  description = "Custom cluster parameter group with SSL enforced"

  parameter {
    name         = "rds.force_ssl"
    value        = "1"
    apply_method = "pending-reboot"
  }
}

# Example RDS cluster using that parameter group
resource "aws_rds_cluster" "POSTGRES_CLUSTER" {
  cluster_identifier              = "POSTGRES_CLUSTER_IDENTIFIER" # replace with your cluster identifier
  engine                          = "aurora-postgresql"           # or "postgres" for non-Aurora PostgreSQL
  master_username                 = "MASTER_USERNAME"             # replace
  master_password                 = "MASTER_PASSWORD"             # replace (or use secrets manager)
  db_cluster_parameter_group_name = aws_rds_cluster_parameter_group.POSTGRES_CLUSTER_PG.name

  # ... other required arguments ...
}

Notes and impact:

  • This matches the CLI remediation by setting rds.force_ssl to 1 in the cluster parameter group with apply_method = "pending-reboot", which forces all connections to use SSL/TLS.
  • This is only valid for PostgreSQL-based RDS/Aurora engines; there is no equivalent server-side enforcement parameter for SQL Server on RDS.
  • If you are currently using an AWS default cluster parameter group, you must:
    • Create this custom aws_rds_cluster_parameter_group.
    • Point your aws_rds_cluster.db_cluster_parameter_group_name at it (as above).
  • The parameter change will take effect only after you reboot all DB instances in the cluster, causing a service interruption. Terraform itself will not replace the cluster for this change, but you must plan for the outage when you perform the reboot in AWS.

Verification:

  • Run terraform plan. You should see either:
    • A new aws_rds_cluster_parameter_group with parameter rds.force_ssl set to 1 and the cluster updated to use it, or
    • A change on the existing parameter group where rds.force_ssl is added or updated from another value to "1".