RDS for SQL Server DB instances should be encrypted in transit

How to fix it

• Interrupts service: rds.force_ssl is static here: nothing changes until the instance reboots, though this check passes as soon as the group holds 1, and an instance on a default group needs a custom group first.
• Can break clients: Clients need no change to be encrypted, though AWS notes that SSMS 19.3, 20.0 and 20.2 need Trust Server Certificate enabled and the RDS certificate imported.

In the console

RDS → Parameter groups → the group attached to the DB instance

rds.force_ssl

1

With the AWS CLI

aws rds modify-db-parameter-group --db-parameter-group-name <parameter-group-name> --parameters ParameterName=rds.force_ssl,ParameterValue=1,ApplyMethod=pending-reboot --region <region>

With Terraform

resource "aws_db_parameter_group" "this" {
  name   = var.parameter_group_name
  family = var.family

  parameter {
    name         = "rds.force_ssl"
    value        = "1"
    apply_method = "pending-reboot"
  }
}