turbot/alicloud_compliance

Control: 6.1 Ensure that RDS instance requires all incoming connections to use SSL

Description

It is recommended to enforce all incoming connections to SQL database instance to use SSL.

Remediation

From Console

  1. Logon to RDS Console.
  2. Select the region where the target instance is located.
  3. Click the ID of the target instance to enter the Basic Information page.
  4. In the left-side navigation pane, click Data Security.
  5. Click the SSL Encryption tab.
  6. Click the switch next to Disabled in the SSL Encryption parameter.
  7. In the Configure SSL dialog box, select the endpoint for which you want to enable SSL encryption and then click OK.
  8. Click Download CA Certificate to download an SSL certificate.
  9. The downloaded SSL certificate is a package including the following files:
    • p7b file: is used to import the CA certificate on Windows OS.
    • PEM file: is used to import the CA certificate on other systems or for other applications.
    • JKS file: is a Java truststore certificate file used for importing CA certificate chains in Java programs. The password is apsaradb.

Usage

Run the control in your terminal:

powerpipe control run alicloud_compliance.control.cis_v100_6_1

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run alicloud_compliance.control.cis_v100_6_1 --share

SQL

This control uses a named query:

rds_instance_ssl_enabled

Tags