Is it possible to enable RDS connection encryption in Spryker PaaS?

victor.vanherpt

We are getting a requirement to enable the encrypted connection. I don't see any obvious settings or docs, but I see it would pe possible to provide 'options' to PDO.

Would it be acomplishable in default spryker PaaS out of the box (just changing project code)? Or would we need to have infrastructure setup?

amansilla

Hi @victor.vanherpt

I'd like to clarify the type of encryption you're referring to. In Spryker Cloud, SSL is automatically enabled for connections to the RDS database, ensuring secure, encrypted connections. Additionally, our database is kept within a VPC, eliminating exposure to the public network. With these security measures in place, our setup is sufficiently secure.

If you believe additional security measures are needed, it might involve changes at both the project code and infrastructure levels. For detailed guidance, I recommend creating a support ticket, allowing our cloud and solution architects to assist you with your request.

Cheers :)

victor.vanherpt

Hi @amansilla , thanks for answering. Can you give me a hint on where to check this?
I tried running the debugger to see how the database connection was instantiated and I saw no details on tls encryption. Or is this something happening by default on AWS?
I also didn't see any obvious settings by default in the config for production, unless spryker is adding something else that I'm missing.
This is comming from a security check by our customer, they want to ensure that sensitive data is encrypted in transport in all layers.

amansilla

Hi @victor.vanherpt

To the best of my understanding, there's typically no need for additional setup at the project level to enable SSL for database connections, as AWS provides this feature by default. While I can't disclose specific customer information, you might consider reaching out through a support ticket for further details.

Cheers ;)

victor.vanherpt

Thanks again :) I guess the most empiric test would be to disallow non encrypted connections in our -dev envirnoment :D