How can I turn on SSL on my Aurora PostgreSQL-Compatible DB instance and how can I connect to my instance using SSL certificates?
I want to connect to my Amazon Aurora PostgreSQL-Compatible Edition DB cluster using a Secure Socket Layer (SSL) connection.
"I want to connect to my Amazon Aurora PostgreSQL-Compatible Edition DB cluster using a Secure Socket Layer (SSL) connection.Short descriptionYou can encrypt a connection to your Aurora PostgreSQL-Compatible DB cluster from your application using either SSL or Transport Layer Security (TLS). SSL and TLS connections provide a single layer of security for your cluster, and encrypt the data that moves between your client and cluster. For more information, see Using SSL/TLS to encrypt a connection to a DB cluster.To be secure, SSL connections must be configured on both the client and server before you make the connection. If SSL is not configured on the server, then the client might send sensitive information like passwords. For more information on creating an SSL-secured connection, see the PostgreSQL documentation for SSL support.The SSL modes for PostgreSQL are:verify-fullverify-carequirepreferallowdisableFor more information on choosing the right SSL mode for your use case, see the PostgreSQL documentation for Protection provided in different modes.ResolutionAmazon Relational Database Service (Amazon RDS) creates the SSL or TLS certification for your cluster when you create it. For more information, see Security with Amazon Aurora PostgreSQL.Connect to your DB cluster over SSL/TLS1.    Download the SSL/TSL certificate.2.    Import the certificate into your operating system.3.    Connect to your Aurora PostgreSQL-Compatible DB cluster over SSL/TLS.See this example:psql -h DBInstance.cluster-Account-Number.eu-west-1.rds.amazonaws.com  -p 5432 "dbname=postgres user=postgres sslrootcert=global-bundle.pem sslmode=verify-full"When you set rds.force_ssl to 1 (on), your DB instance's pg_hba.conf file is modified to support the new SSL configuration. You can use the pg_hba_file_rules view to see the summary of contents of the pg_hba.conf file. The type value in the pg_hba_file_rules view is updated to hostssl after rds.force_ssl is set to 1 (on).You can make it a requirement that connections to your DB cluster use SSL/TLS. To do this, use the rds.force_ssl parameter. The rds.force_ssl parameter is set to 0 by default, meaning it is turned off. To turn this parameter on, set rds.force_ssl to 1. This makes SSL/TLS a requirement for connections to your DB cluster.For more information, see Securing Aurora PostgreSQL data with SSL/TLS.Review the SSL connectionTo review that the SSL connection, run this command:postgres=> select ssl_is_used(); ssl_is_used------------- t(1 row)postgres=> select ssl_cipher();         ssl_cipher----------------------------- ECDHE-RSA-AES128-GCM-SHA256(1 row)Follow"