RDS SSL Certificate Rotation: Everything You Need to Know for a Smooth Transition

Amazon RDS SSL CA certificates rds-ca-2019 are expiring soon. To maintain secure connections, switch to new CA certificates: rds-ca-rsa2048-g1, rds-ca-rsa4096-g1, or rds-ca-ecc384-g1. This guide outlines the steps to update your clients or applications and RDS certificates.

RDS SSL/TLS Certificate Rotation Guide for Amazon RDS

Amazon RDS provides the following CA’s to sign the DB server certificate for a DB instance.

This can also be done via the AWS-CLI

aws rds describe-db-engine-versions --default-only --engine postgres

Preparing for RDS SSL Update

1. Update Before Rotation: Update clients or applications connecting to RDS databases before rotating certificates. You will likely need to update them with the latest RDS global certificates found here.
2. New CA Certificates: Refer to AWS documentation for details on new certificates and supported regions.
3. RDS Proxy: No update is required for applications using RDS Proxy connections. (if applicable)
4. Go Version 1.15: Update the certificate if using a Go version 1.15 application that had the rds-ca-2019 certificate before July 28, 2020. (if applicable)

Updating Your Clients or Applications for RDS SSL

1. Download the New Certificate: Download the new SSL/TLS certificate as per the documentation.
2. Update Applications: Collaborate with application developers to update the SSL/TLS certificates within your applications.
3. Specific DB Engines: Follow the documentation for updating applications for various DB engines, including MariaDB, Microsoft SQL Server, MySQL, Oracle, and PostgreSQL.
4. Certificate Bundle: Use the provided certificate bundle to maintain connectivity during the transition.

Step-by-Step Procedure

Step 1 – Preparing for the Update

• Backup: Create a snapshot or automated backup of your RDS instance.
• Communication: Inform relevant stakeholders (developers, system administrators, etc.) about the planned update and potential downtime.
• Test Environment: If possible, replicate your production environment for testing to minimize risks.

Step 2 – Update Clients

Step 3 – Update RDS Certificates

• Log in to AWS Management Console: Navigate to the RDS section.
• Select the RDS Instance: Choose the DB instance to modify.

• Initiate Modification: Click on the Modify button.
• Update CA Certificate: Change the CA to the new certificate.
• Apply Changes immediately or schedule them for the next maintenance window.

• Monitor RDS Instance: Monitor the RDS instance for any issues.

Step 4 – Post-Update

• RDS Monitoring: Use CloudWatch metrics to monitor your RDS instance for any connection errors or performance issues.
• Application Monitoring: Monitor your application logs for any unexpected behavior or errors related to the certificate change.
• Roll Back Plan: Have a rollback plan in place in case of unforeseen problems.

Ansible Script to pull all this information from your AWS Account

Note:

• Make sure you configure your AWS_ACCESS_KEY and SECURE_TOKEN in your local console.
• Make sure you change the value for your ECS Clusters.

- name: Get ECS Task Details
  ignore_errors: true  
  hosts: localhost
  tasks:
    - name: List All Task ARNs in the Cluster
      shell: "aws ecs list-tasks --cluster ecs-cluster-prod"
      register: task_list

    - name: Get Details of Each Task
      shell: "aws ecs describe-tasks --cluster ecs-cluster-prod --tasks {{ task_list.stdout | from_json | json_query('taskArns[]') | join(' ') }}"
      register: task_details

    - name: Extract Task Details
      set_fact:
        task_info: "{{ task_details.stdout | from_json | json_query('tasks[*].{Name: taskDefinitionArn, Group: group, Image: containers[0].image, PrivateIP: containers[0].networkInterfaces[0].privateIpv4Address}') }}"

    - name: Get Load Balancer Details
      shell: "aws ecs describe-services --cluster ecs-cluster-qa --services {{ item | regex_replace('service:', '') }}"
      register: service_details
      loop: "{{ task_details.stdout | from_json | json_query('tasks[*].group') | map('regex_replace', '^task:', '') | list }}"

    - name: Display Task Details
      debug:
        msg: "{{ task_info }}"

    - name: Extract Load Balancer Details
      set_fact:
        lb_info: "{{ service_details.results | map(attribute='stdout') | map('from_json') | map('json_query', \"services[0].loadBalancers[0].{ContainerName: containerName, ContainerPort: containerPort, TargetGroupArn: targetGroupArn, }\") }}"

    - name: Display Load Balancer Details
      debug:
        msg: "{{ lb_info }}"

Additional Best Practices:

• Automate: Whenever possible, script the process for future certificate rotations to streamline the process and reduce manual errors.
• Communication: Keep stakeholders informed of the progress and any potential impacts.
• Documentation: Document the steps taken and any issues encountered for future reference.