Alibaba CloudOverview
It is recommended to enforce all incoming connections to SQL database instance to use SSL.
SQL database connections if successfully trapped (MITM); can reveal sensitive data like credentials, database queries, query outputs etc. For security, it is recommended to always use SSL encryption when connecting to your instance. This recommendation is applicable for PostgreSQL and MySQL Instances.
Default Value
Encryption is off by default.
Additional Information
You can choose to encrypt the private or public endpoint, but note that you can encrypt only one endpoint.
Remediation guidance
Console
- Open the ApsaraDB RDS instance using the "Open in Alibaba" menu option
- In the left-side navigation pane, click
Data Security. - Click the
SSL Encryptiontab. - Click the switch next to
Disabledin theSSL Encryptionparameter. - In the Configure SSL dialog box, select the endpoint for which you want to enable SSL encryption and then click
OK. - Click
Download CA Certificateto download an SSL certificate.
The downloaded SSL certificate is a package including the following files:
- p7b file: is used to import the CA certificate on Windows OS
- PEM file: is used to import the CA certificate on other systems or for other applications
- JKS file: is a Java truststore certificate file used for importing CA certificate chains in Java programs
The password is apsaradb.
Service-wide remediation
Recommended when many resources are affected: fix the platform baseline first so new resources inherit the secure setting, then remediate the existing flagged resources in batches.
Alibaba Cloud
Use Resource Directory guardrails, account baselines, and IaC modules so the secure setting is applied consistently across environments.
Operational rollout
- Fix the baseline first at the account, subscription, project, cluster, or tenant scope that owns this control.
- Remediate the currently affected resources in batches, starting with internet-exposed and production assets.
- Re-scan and track approved exceptions with an owner and expiry date.
Query logic
These are the stored checks tied to this control.
RDS instances require all incoming connections to use SSL
Connectors
Covered asset types
Expected check: eq []
AlibabaRDS2{...AssetFragment}
