Alibaba CloudOverview
It is recommended to enforce all incoming connections to SQL database instance to use SSL.
SQL database connections if successfully trapped (MITM); can reveal sensitive data like credentials, database queries, query outputs etc. For security, it is recommended to always use SSL encryption when connecting to your instance. This recommendation is applicable for PostgreSQL and MySQL Instances.
Default Value
Encryption is off by default.
Additional Information
You can choose to encrypt the private or public endpoint, but note that you can encrypt only one endpoint.
Remediation guidance
Console
- Open the ApsaraDB RDS instance using the "Open in Alibaba" menu option
- In the left-side navigation pane, click
Data Security. - Click the
SSL Encryptiontab. - Click the switch next to
Disabledin theSSL Encryptionparameter. - In the Configure SSL dialog box, select the endpoint for which you want to enable SSL encryption and then click
OK. - Click
Download CA Certificateto download an SSL certificate.
The downloaded SSL certificate is a package including the following files:
- p7b file: is used to import the CA certificate on Windows OS
- PEM file: is used to import the CA certificate on other systems or for other applications
- JKS file: is a Java truststore certificate file used for importing CA certificate chains in Java programs
The password is apsaradb.
Multiple Remediation Paths
SERVICE-WIDE (RECOMMENDED when many resources are affected): Apply organization/tenant-level guardrails and baseline policies for the entire platform.
ASSET-LEVEL: Fix only the affected resources identified by this control.
PREVENTIVE: Add preventive policy checks to CI/CD and periodic posture scans.
References for Service-Wide Patterns
- Platform policy/governance and preventive control patterns should be applied tenant-wide where supported.
Query logic
These are the stored checks tied to this control.
RDS instances require all incoming connections to use SSL
Connectors
Covered asset types
Expected check: eq []
AlibabaRDS2{...AssetFragment}
