RDS Aurora cluster parameter groups should require TLS for client connections
Implementation
Choose the approach that matches how you manage Terraform.
Use the compliance.tf module to enforce this control by default. See get started with compliance.tf.
module "rds_aurora" {
source = "soc2.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
availability_zones = ["eu-west-1a", "eu-west-1b"]
backtrack_window = 1
cloudwatch_log_group_kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
cluster_parameter_group = {
family = "aurora-mysql8.0"
parameters = [
{
apply_method = "pending-reboot"
name = "require_secure_transport"
value = "ON"
},
{
apply_method = "pending-reboot"
name = "server_audit_logging"
value = "1"
},
]
}
instances = {
reader = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
writer = {
auto_minor_version_upgrade = true
instance_class = "db.r6g.large"
}
}
kms_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
port = "3307"
}This control is enforced automatically with Compliance.tf modules. Start free trial
If you use terraform-aws-modules/rds-aurora/aws, set the right module inputs for this control. You can later migrate to the compliance.tf module with minimal changes because it is compatible by design.
module "rds_aurora" {
source = "terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
engine = "aurora-mysql"
name = "example"
cluster_parameter_group = {
family = "aurora-mysql8.0"
parameters = [
{
apply_method = "pending-reboot"
name = "require_secure_transport"
value = "ON"
},
]
}
}Use AWS provider resources directly. See docs for the resources involved: aws_rds_cluster_parameter_group.
resource "aws_rds_cluster_parameter_group" "this" {
family = "aurora-mysql8.0"
name = "example-abc123"
parameter {
name = "require_secure_transport"
value = "ON"
}
parameter {
name = "server_audit_logging"
value = "1"
}
}Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
rds_db_cluster_parameter_group_encryption_in_transit_enabled
Stop fixing controls one by one. Compliance.tf modules enforce 142 module-backed controls for SOC 2 automatically.