RDS for MySQL DB instances should be encrypted in transit

How to fix it

• Interrupts service: If the instance is on a default parameter group, which cannot be edited, attach a custom group holding this value; it applies only after a reboot, though this check passes before then.
• Can break clients: Once it applies, MySQL refuses any connection without SSL/TLS (error 3159), so move every application, job and agent onto SSL/TLS first.

In the console

RDS → Parameter groups → the group attached to the DB instance

require_secure_transport

1

With the AWS CLI

aws rds modify-db-parameter-group --db-parameter-group-name <parameter-group-name> --parameters ParameterName=require_secure_transport,ParameterValue=1,ApplyMethod=immediate --region <region>

With Terraform

resource "aws_db_parameter_group" "this" {
  name   = var.parameter_group_name
  family = var.family

  parameter {
    name  = "require_secure_transport"
    value = "1"
  }
}