Medium
RDS
Regional
RDS for SQL Server DB instances should be encrypted in transit
FSBP
Description
Checks if Amazon RDS for SQL Server DB instances are configured to use encryption in transit. The control fails if the SQL Server DB instance is not configured to require SSL/TLS encryption for connections by setting the require_ssl parameter to 1.
Remediation
To enable encryption in transit for SQL Server DB instances, follow these steps:
Steps
- Sign in to the AWS Management Console and open the Amazon RDS console.
- In the navigation pane, choose 'Databases'.
- Select the identified SQL Server DB instance that requires encryption in transit.
- Choose 'Modify'.
- In the 'Database Options' section, locate the 'DB parameter group' setting.
- If using a custom parameter group, modify the 'require_ssl' parameter to '1'.
- If using the default parameter group, create a new custom parameter group and set 'require_ssl' to '1'.
- Apply the parameter group to your DB instance.
- Scroll to the bottom of the page and choose 'Continue'.
- On the summary page, review your changes. Select 'Apply immediately' to enable encryption right away, or choose to apply them during the next maintenance window.
- Click 'Modify DB Instance' to apply the changes.
- For detailed guidance, refer to the AWS documentation: 'Using SSL/TLS to encrypt a connection to a DB instance' in the Amazon RDS User Guide.
Compliance
FSBP