---
title: "Force encryption on every managed service · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/networking-and-dns/enforce-tls-on-services
updated: 2026-10-20
licence: "All rights reserved"
---

# Force encryption on every managed service

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Networking and DNS](https://agentwranglers.se/playbook/infrastructure/networking-and-dns)
- Rule: Configure every database, cache and bucket to refuse plain connections. Make every client check the server's certificate.
- How: Encrypting traffic between your own servers is required by [encrypt data](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/encrypt-data). This rule enforces it on the server side. Set the service's own switch, such as `rds.force_ssl` for PostgreSQL on RDS or transit encryption on a Redis cache. Newer engines often turn it on by default, so set it in code anyway. Give buckets a policy that denies any request where `aws:SecureTransport` is false. On the client, use the provider's certificate bundle and full verification, such as `sslmode=verify-full`.
- Check: A database connection without TLS is refused. A client given a wrong host name fails the certificate check. A bucket request over plain HTTP gets 403.

Example:

```hcl
resource "aws_db_parameter_group" "orders" {
  family = "postgres17"
  parameter {
    name  = "rds.force_ssl"
    value = "1"
  }
}
```

```js
import pg from 'pg';
import { readFileSync } from 'node:fs';

const pool = new pg.Pool({
  connectionString: process.env.DATABASE_URL,
  ssl: { ca: readFileSync('/etc/ssl/certs/rds-global-bundle.pem', 'utf8'), rejectUnauthorized: true },
});
```

```python
import os
import psycopg

conn = psycopg.connect(os.environ["DATABASE_URL"], sslmode="verify-full", sslrootcert="/etc/ssl/certs/rds-global-bundle.pem")
```

```sh
psql "host=orders.internal.example.com dbname=shop sslmode=disable" -c 'select 1'   # must fail
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers infrastructure playbook: https://agentwranglers.se/playbook/infrastructure/networking-and-dns/enforce-tls-on-services`.

- Previous: [Limit where servers can send traffic](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/egress-control)
- Next: [Require tokens for the metadata service](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/metadata-service-tokens)
- [Networking and DNS](https://agentwranglers.se/playbook/infrastructure/networking-and-dns)