Amazon DocumentDB clusters should be encrypted in transit

How to fix it

• Interrupts service: tls is static, so it applies only as each instance reboots, although this check reads the group's value and passes before then.
• Can break clients: Once it applies, the cluster refuses clients connecting without TLS or below the version you set, so move every client onto TLS 1.2 or later first.

In the console

Amazon DocumentDB → Parameter groups → the cluster parameter group attached to the cluster

tls

tls1.2+ or tls1.3+ (DocumentDB 4.0 or later), or fips-140-3 where offered; enabled and disabled fail

Cluster parameter group

A custom group, if the cluster is on a default.* group, whose tls cannot be edited

With the AWS CLI

aws docdb modify-db-cluster-parameter-group --db-cluster-parameter-group-name <parameter-group-name> --parameters ParameterName=tls,ParameterValue=tls1.2+,ApplyMethod=pending-reboot --region <region>

With Terraform

resource "aws_docdb_cluster_parameter_group" "this" {
  name   = var.parameter_group_name
  family = var.family

  parameter {
    name         = "tls"
    value        = "tls1.2+"
    apply_method = "pending-reboot"
  }
}