Force encryption on every managed service

How to do it

Encrypting traffic between your own servers is required by encrypt data. This rule enforces it on the server side. Set the service's own switch, such as rds.force_ssl for PostgreSQL on RDS or transit encryption on a Redis cache. Newer engines often turn it on by default, so set it in code anyway. Give buckets a policy that denies any request where aws:SecureTransport is false. On the client, use the provider's certificate bundle and full verification, such as sslmode=verify-full.

Example

resource "aws_db_parameter_group" "orders" {
  family = "postgres17"
  parameter {
    name  = "rds.force_ssl"
    value = "1"
  }
}

import pg from 'pg';
import { readFileSync } from 'node:fs';

const pool = new pg.Pool({
  connectionString: process.env.DATABASE_URL,
  ssl: { ca: readFileSync('/etc/ssl/certs/rds-global-bundle.pem', 'utf8'), rejectUnauthorized: true },
});

import os
import psycopg

conn = psycopg.connect(os.environ["DATABASE_URL"], sslmode="verify-full", sslrootcert="/etc/ssl/certs/rds-global-bundle.pem")

psql "host=orders.internal.example.com dbname=shop sslmode=disable" -c 'select 1'   # must fail

How to check

A connection without TLS is refused. A client given a wrong host name fails the certificate check.