cis-aws-database-2-3

name	cis-aws-database-2.3
description	Ensure Data in Transit Encryption is Enforced
category	cis-database
version	2.0.0
author	cyberstrike-official
tags	["cis","aws","database","aurora","encryption","tls","ssl","data-in-transit"]
cis_id	2.3
cis_benchmark	CIS AWS Database Services Benchmark v2.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-database-2.2"]
prerequisites	[]
severity_boost	{}

2.3 Ensure Data in Transit Encryption is Enforced (Manual)

Description

Use TLS (Transport Layer Security) to secure data in transit. Aurora supports TLS-encrypted connections between your application and your DB instance, and this configuration can be enforced so non-TLS connections are prohibited.

Rationale

Encrypting data in transit protects sensitive information from interception and tampering by unauthorized parties. Aurora supports TLS for securing client connections, however it is essential to ensure that client applications are properly configured to use TLS and that the database enforces encrypted connections.

Impact

Disabling or failing to properly configure TLS can expose the data to be compromised by malicious actors, potentially resulting in data breaches, credential theft, or other security compromises.

Audit Procedure

Using AWS Console

1. Sign in to the AWS Management Console where the Aurora database cluster you are auditing resides.
2. Navigate to the Amazon Aurora and RDS Dashboard:
   • You can find this under the Database category.
3. Select the DB cluster name you wish to audit:
   • This opens the details page for your specific Aurora cluster.
4. Under Configuration, locate the DB cluster parameter group attached to this cluster:
   • Click on the parameter group name to review its parameters.
5. Verify the following engine-specific parameters to confirm encryption in transit is enforced:
   • PostgreSQL: Confirm that rds.force_ssl = 1
   • MySQL: Confirm that require_secure_transport = ON (Only applicable for Aurora MySQL versions 2 and 3)

Notes:

• Make sure the parameter changes are applied and the cluster has been rebooted if necessary for the parameters to take effect.

Expected Result

• For PostgreSQL Aurora clusters: rds.force_ssl should be set to 1
• For MySQL Aurora clusters: require_secure_transport should be set to ON

Remediation

Using AWS Console

1. Sign in to the AWS Management Console where the Aurora database cluster you are remediating resides.
2. Navigate to the Amazon Aurora and RDS Dashboard:
   • You can find this under the Database category.
3. Select the DB cluster name you wish to remediate: