AWS RDS database instance not configured with encryption in transit misconfiguration detected in cod

Rule Details

Cortex AppSec Rule ID	APPSEC2_AWS_69
Category - Subcategory	Public Exposure - Encryption And Protocols
Provider	AWS
Severity	MEDIUM
Framework	CloudFormation, Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	4ea6de73-a950-4d1b-95ba-84a5d9f4b5d4

Impact

This rule detects whether an Amazon RDS database instance is not configured to use data-in-transit encryption, potentially exposing sensitive data to unauthorized access through unencrypted data transmission between the database and other services or clients. A lack of encryption in transit increases the risk of data interception and unauthorized access, leading to potential data breaches. Implementing encryption in transit is crucial for maintaining data integrity and confidentiality in cloud environments."

How to Fix

Resource: AWS::RDS::DBInstance, AWS::RDS::DBParameterGroup

• Arguments: Parameters

This example shows how to configure SSL enforcement for a DB2 instance using an AWS RDS DBParameterGroup in a CloudFormation template. [source,go]

Resources: DB2PassParam: Type: "AWS::RDS::DBParameterGroup" Properties: Description: "My DB2 parameter group" Family: "1db2-ae1" Parameters: db2comm: "SSL"