Amazon RDS
      Back to home
      1. CNS Policies
      2. AWS Knowledge Base
      3. Amazon RDS

      RDS Transport Encryption Disabled

      Risk Level: MEDIUM

      Description:

       This plugin enables Transport Encryption for RDS SQL Server instances. To handle encryption and decryption, the RDS instance's parameter group should have transport encryption enabled.


      Recommended Action:    Update the parameter group associated with the RDS instance to have rds.force_ssl set to true.

      About the Service :

      Amazon RDS (Amazon Relational Database Service) makes it simple to set up, run, and scale a relational database in the cloud. It offers scalable capacity at a low cost while automating time-consuming administrative activities including hardware provisioning, database setup, patching, and backups. 

      Impact: 

      All connections to Amazon RDS SQL Server and PostgreSQL instances that process, store, or transmit PHI (Protected Health Information) must employ the RDS Transport Encryption feature, which essentially turns on the force SSL setting.

      Steps to reproduce :

      1. Sign in to your AWS management console.
      2. Navigate to the RDS dashboard at: https://console.aws.amazon.com/rds/
      3. On the left navigation panel, under RDS Dashboard, select Databases.
      4. Select the RDS instance that you want to examine.
      5. Under the Configuration panel, in the Instance panel, check the value of Parameter Group, and copy its value.
      6. In the Amazon RDS navigation panel, click on Parameter Groups.
      7. Search for the copied value in step 5, and open it.
      8. On the page of the selected parameter that opens, search for the rds.force_ssl parameter.
      9. If the current value of this parameter is set to 0, the Transport Encryption feature is not enabled for the selected AWS RDS database instance.
      10. Repeat steps no. 4 – 10 for each RDS instance provisioned in the current region as well as in other AWS regions.


      Steps for remediation :

      1. Sign in to your AWS management console.
      2. Navigate to the RDS dashboard at: https://console.aws.amazon.com/rds/
      3. On the left navigation panel, under RDS Dashboard, select Databases.
      4. Copy the value of Parameter Group of required database instance as done in the Audit section.
      5. In the Amazon RDS navigation panel, click on Parameter Groups and search for the copied parameter group value.
      6. On the Parameter listing page, enter rds.force_ssl parameter name in the Filter parameters search box and press Enter.
      7. Select the returned parameter then click the Edit parameters button.
      8. Change the value of the parameter from 0 to 1 and click on Save Changes. 
      9. Once this value is changed and set to 1, go back to database instances and open the same instance.
      10. On the instance page that opens, click on Actions, and select Reboot.
      11. Provide rebooting confirmation.
      12. Repeat steps no. 4 – 11 for each SQL Server and PostgreSQL database instance that doesn't have Transport Encryption feature enabled, available in the current region as well as in other AWS regions.


      References: