DocDB TLS is disabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_90
Category - Subcategory	Public Exposure - Encryption And Protocols
Provider	AWS
Severity	MEDIUM
Framework	CloudFormation, Serverless, Terraform, Terraform Plan

Impact

TLS can be used to encrypt the connection between an application and a DocDB cluster. By default, encryption in transit is enabled for newly created clusters. It can optionally be disabled when the cluster is created, or at a later time. When enabled, secure connections using TLS are required to connect to the cluster.

How to Fix

Resource: AWS::DocDB::DBClusterParameterGroup

• Argument: Parameters.tls [source,go]

---

Resources: DocDBParameterGroupEnabled: Type: AWS::DocDB::DBClusterParameterGroup Properties: ... Parameters: ...

• tls: "disabled"
• tls: "enabled"

---