All checks
Medium
RDS for SQL Server DB instances should be encrypted in transit
Checks that RDS for SQL Server DB instances set rds.force_ssl to 1 in their DB parameter group, which makes SQL Server encrypt every connection. Without it, a client that does not ask for encryption sends its queries and results unencrypted.
- service
- RDS
- severity
- Medium
- scope
- evaluated in every region
How to fix it
In the console
RDS → Parameter groups → the group attached to the DB instance
With the AWS CLI
aws rds modify-db-parameter-group --db-parameter-group-name <parameter-group-name> --parameters ParameterName=rds.force_ssl,ParameterValue=1,ApplyMethod=pending-reboot --region <region>With Terraform
resource "aws_db_parameter_group" "this" {
name = var.parameter_group_name
family = var.family
parameter {
name = "rds.force_ssl"
value = "1"
apply_method = "pending-reboot"
}
}See which of your accounts this check is failing on.
Book a demo