Back to Checks
alibabacloud

RDS instance has SSL encryption enabled

rds_instance_ssl_enabled
Service: rdsSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:ALIYUN::RDS::DBInstance

Alibaba Cloud RDS instances should enforce SSL encryption for all incoming connections. SSL protects data in transit between the application and the database, preventing interception of sensitive data such as credentials, database queries, and query outputs. This check verifies that SSL encryption is enabled on the RDS instance.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

If SSL is not enabled, data in transit including credentials and query results can be intercepted by attackers performing Man-in-the-Middle (MITM) attacks. This compromises data confidentiality and integrity, potentially leading to credential theft, data exfiltration, and unauthorized manipulation of database communications.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks rds_instance_ssl_enabled

Recommendation

Enable SSL encryption on all RDS instances to protect data in transit and prevent Man-in-the-Middle attacks.

Remediation

CLI

aliyun rds ModifyDBInstanceSSL --DBInstanceId <instance_id> --SSLEnabled 1

Terraform

resource "alicloud_db_instance" "example" {
  engine           = "MySQL"
  engine_version   = "8.0"
  instance_type    = "rds.mysql.s1.small"
  instance_storage = 20
  ssl_action       = "Open"
}

Other

1Log on to the **RDS Console**.
2Select the region and target instance.
3In the left-side navigation pane, click **Data Security**.
4Click the **SSL Encryption** tab.
5Click the switch next to **Disabled** to enable SSL encryption.
6Download the SSL CA certificate for client configuration.

Check Code

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.rds.rds_client import rds_client


class rds_instance_ssl_enabled(Check):
    """Check if RDS instance requires all incoming connections to use SSL."""

    def execute(self) -> list[CheckReportAlibabaCloud]:
        findings = []

        for instance in rds_client.instances:
            report = CheckReportAlibabaCloud(
                metadata=self.metadata(), resource=instance
            )
            report.region = instance.region
            report.resource_id = instance.id
            report.resource_arn = f"acs:rds:{instance.region}:{rds_client.audited_account}:dbinstance/{instance.id}"

            if instance.ssl_enabled:
                report.status = "PASS"
                report.status_extended = (
                    f"RDS Instance {instance.name} has SSL encryption enabled."
                )
            else:
                report.status = "FAIL"
                report.status_extended = f"RDS Instance {instance.name} does not have SSL encryption enabled."

            findings.append(report)

        return findings

References