RDS for PostgreSQL DB instances should be encrypted in transit

How to fix it

• Interrupts service: If the instance is on a default parameter group, which cannot be edited, attach a custom group holding this value; it applies only after a reboot, though this check passes before then.
• Can break clients: Once it applies, PostgreSQL rejects any connection without SSL/TLS, so move every application, job and agent onto SSL/TLS first.

In the console

RDS → Parameter groups → the group attached to the DB instance

rds.force_ssl

1

With the AWS CLI

aws rds modify-db-parameter-group --db-parameter-group-name <parameter-group-name> --parameters ParameterName=rds.force_ssl,ParameterValue=1,ApplyMethod=immediate --region <region>

With Terraform

resource "aws_db_parameter_group" "this" {
  name   = var.parameter_group_name
  family = var.family

  parameter {
    name  = "rds.force_ssl"
    value = "1"
  }
}