Control: 6.1 Ensure that RDS instance requires all incoming connections to use SSL

Description

It is recommended to enforce all incoming connections to SQL database instance to use SSL.

Remediation

From Console

1. Logon to RDS Console.
2. Select the region where the target instance is located.
3. Click the ID of the target instance to enter the Basic Information page.
4. In the left-side navigation pane, click Data Security.
5. Click the SSL Encryption tab.
6. Click the switch next to Disabled in the SSL Encryption parameter.
7. In the Configure SSL dialog box, select the endpoint for which you want to enable SSL encryption and then click OK.
8. Click Download CA Certificate to download an SSL certificate.
9. The downloaded SSL certificate is a package including the following files:
   • p7b file: is used to import the CA certificate on Windows OS.
   • PEM file: is used to import the CA certificate on other systems or for other applications.
   • JKS file: is a Java truststore certificate file used for importing CA certificate chains in Java programs. The password is apsaradb.