Control: 6 Amazon DocumentDB clusters should be encrypted in transit

Description

This controls checks whether an Amazon DocumentDB cluster requires TLS for connections to the cluster. The control fails if the cluster parameter group associated with the cluster is not in sync, or the TLS cluster parameter is set to disabled or enabled.

You can use TLS to encrypt the connection between an application and an Amazon DocumentDB cluster. Use of TLS can help protect data from being intercepted while the data is in transit between an application and an Amazon DocumentDB cluster. Encryption in transit for an Amazon DocumentDB cluster is managed using the TLS parameter in the cluster parameter group that's associated with the cluster. When encryption in transit is enabled, secure connections using TLS are required to connect to the cluster. We recommend using the following TLS parameters: tls1.2+, tls1.3+, and fips-140-3

Remediation

For information about changing the TLS settings for an Amazon DocumentDB cluster, see Encrypting data in transit in the Amazon DocumentDB Developer Guide.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.foundational_security_docdb_6

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.foundational_security_docdb_6 --share

SQL

This control uses a named query:

with docdb_cluster as materialized (
  select
    db_cluster_parameter_group,
    arn,
    account_id,
    region,
    engine,
    tags,
    title,
    _ctx
  from
    aws_docdb_cluster
), docdb_pg_tls_settings as (
  select
    g.name,
    p ->> 'ParameterValue'
  from
    docdb_cluster as c,
    aws_rds_db_cluster_parameter_group as g,
    jsonb_array_elements(parameters) as p
  where
    c.db_cluster_parameter_group = g.name
    and g.account_id = c.account_id
    and g.region = c.region
    and p ->> 'ParameterName' = 'tls'
   and p ->> 'ParameterValue' in ('disabled', 'enabled')
)
select
  c.arn as resource,
  c.engine,
  case
    when p.name is not null then 'alarm'
    else 'ok'
  end as status,
  case
    when p.name is not null then title || ' encryption in transit disabled.'
    else title || ' encryption in transit enabled.'
  end as reason
  
  , region, account_id
from
  docdb_cluster as c
  left join docdb_pg_tls_settings as p on p.name = c.db_cluster_parameter_group;

Control: 6 Amazon DocumentDB clusters should be encrypted in transit

Description

Remediation

Usage

SQL

Tags