More Info:
Microsoft SQL Server and PostgreSQL instances provisioned with Amazon RDS should have Transport Encryption feature enabled in order to meet security and compliance requirementsRisk Level
MediumAddress
SecurityCompliance Standards
HITRUST, SOC2, NISTCSF, PCIDSS, FedRAMPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration of enabling transport encryption for AWS RDS using the AWS console, follow these steps:
- Login to AWS Console: Go to the AWS Management Console and log in using your credentials.
- Navigate to RDS Service: Click on the “Services” dropdown menu at the top of the page, search for “RDS” and click on it to open the RDS dashboard.
- Select the RDS Instance: From the list of RDS instances, select the instance for which you want to enable transport encryption by clicking on its name.
- Modify the RDS Instance: In the RDS instance dashboard, click on the “Modify” button at the top right corner.
- Enable Encryption: Scroll down to the “Network & Security” section, and look for the “Encryption” option.
- Enable Encryption: Check the box next to “Enable Encryption” to enable transport encryption for the RDS instance.
- Choose Encryption Type: Select the desired encryption type (e.g., AWS Key Management Service (KMS) key) from the dropdown menu.
- Save Changes: Scroll down to the bottom of the page and click on the “Continue” button.
- Apply Changes: Review the changes you are about to make, and click on the “Modify DB Instance” button to apply the changes.
- Monitor Encryption Status: Once the modification is complete, monitor the RDS instance to ensure that transport encryption is successfully enabled. You can check the status in the RDS dashboard.
Using CLI
Using CLI
To remediate the misconfiguration of enabling Transport Encryption for an AWS RDS instance using the AWS CLI, follow these steps:By following these steps, you can successfully remediate the misconfiguration of enabling Transport Encryption for an AWS RDS instance using the AWS CLI.
- Get the RDS instance identifier: First, identify the RDS instance for which you want to enable Transport Encryption. You can get the instance identifier by running the following AWS CLI command:
- Enable Transport Encryption: Once you have the RDS instance identifier, you can enable Transport Encryption by modifying the instance with the following AWS CLI command. Replace
<instance_identifier>with the actual identifier of your RDS instance:
- Verify Encryption Status: You can verify that Transport Encryption has been enabled for the RDS instance by describing the instance and checking the
StorageEncryptedattribute. Run the following AWS CLI command:
- Wait for the Modification to Complete: The modification to enable Transport Encryption may take some time to complete. You can monitor the status of the modification by describing the RDS instance and checking the
DBInstanceStatusattribute. Run the following AWS CLI command:
Using Python
Using Python
To remediate the misconfiguration of enabling transport encryption for AWS RDS using Python, you can follow these steps:
- Import the necessary libraries:
- Create an AWS RDS client:
- Get a list of all RDS instances:
- Iterate through each RDS instance and enable transport encryption:
- Confirm that the transport encryption is enabled by checking the DB instance details:
- Run the Python script to enable transport encryption for all RDS instances.