# Ensure Data in Transit is Encrypted

- Source: https://support.icompaas.com/support/solutions/articles/62000234437-ensure-data-in-transit-is-encrypted
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS AWS Database Services Benchmark v1.0.0](https://support.icompaas.com/support/solutions/62000112688) › [CIS AWS Database Services Benchmark v1.0.0](https://support.icompaas.com/support/solutions/folders/62000169253)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability:** 

-   **Level 1**

**Description:** Encryption in transit ensures that data remains confidential and protected as it travels from one location to another within the AWS environment. By enabling SSL/TLS, you prevent unauthorized interception and manipulation of data during transmission.

**Rationale:** Data transmitted without encryption can be intercepted and read by malicious actors. Enabling SSL/TLS ensures data confidentiality and integrity in transit between clients and the database service.

**Impact:  
** If the data is intercepted during transmission, it will be unreadable without the decryption key. However, misconfigurations could lead to failed connections from clients not configured to use SSL/TLS.

**Default Value:** By default, some AWS services (like DynamoDB) enable encryption in transit. However, for services like RDS or Aurora, the client must be explicitly configured to use SSL/TLS.

**Pre-requisites:**

-   Access to the AWS Console or CLI
    
-   Administrative privileges for modifying database configurations  
    
-   SSL/TLS certificates (if not using default AWS certificates)  
    

**Remediation**

### **Test Plan**

**Using AWS Console:**

1.  Sign in to the AWS Management Console  
    
2.  Navigate to the database service console (e.g., RDS, DynamoDB, DocumentDB, Neptune)  
    
3.  Select your database instance or cluster  
    
4.  Check under the Encryption in Transit or Connectivity section  
    
5.  Verify that SSL/TLS is enabled  
    

**Using AWS CLI:**

1.  Run the following command for RDS:
    
    aws rds describe-db-instances --query "DBInstances\[\*\].{DBInstanceIdentifier:DBInstanceIdentifier,SSLSupport:EnabledCloudwatchLogsExports}"
    
      
    
2.  For Neptune:  
    
     aws neptune describe-db-clusters
    
      
    
3.  Check for SSL/TLS configuration fields in the output  
    

### **Implementation Plan**

**Using AWS Console:**

1.  Open the relevant database console (e.g., RDS, Neptune)  
    
2.  Select the DB instance or cluster  
    
3.  Click Modify  
    
4.  Under Connectivity or Encryption in Transit, enable SSL/TLS  
    
5.  Choose or upload the SSL certificate if needed  
    
6.  Click Continue or Apply Changes  
    

**Using AWS CLI:**

1.  Modify RDS instance (example):  
    
     aws rds modify-db-instance --db-instance-identifier <instance-id> --ca-certificate-identifier rds-ca-2019 --apply-immediately
    
      
    
2.  Modify Neptune cluster:  
    
     aws neptune modify-db-cluster --db-cluster-identifier <cluster-id> --enable-iam-database-authentication --apply-immediately
    
      
    

### **Backout Plan**

**Using AWS Console:**

1.  Go to the DB instance  
    
2.  Click Modify  
    
3.  Uncheck the Enable SSL/TLS option (if allowed)  
    
4.  Save changes  
    

**Using AWS CLI:**

1.  For RDS:  
    
     aws rds modify-db-instance --db-instance-identifier <instance-id> --no-enable-iam-database-authentication --apply-immediately
    
      
    
2.  For Neptune:  
    
    aws neptune modify-db-cluster --db-cluster-identifier <cluster-id> --disable-iam-database-authentication --apply-immediately
    
      
    

---

**References:**

1.  [AWS Database Encryption in Transit  
    ](https://aws.amazon.com/products/databases/)
    
2.  CIS Controls v8 – Control 3.10: Encrypt Sensitive Data in Transit  
    
3.  CIS Benchmark Document

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.