Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

RDS root certificates must be updated by 3/5/2020 #48

Closed
gramidt opened this issue Oct 11, 2019 · 5 comments
Closed

RDS root certificates must be updated by 3/5/2020 #48

gramidt opened this issue Oct 11, 2019 · 5 comments

Comments

@gramidt
Copy link
Contributor

gramidt commented Oct 11, 2019

Problem: RDS root certificates will be required to be updated from rds-ca-2015 to rds-ca-2019 by 3/5/2020.

Solution: Update the root certificate used for spinning up RDS via Terraform and update the root certificate located in

const RDSRootCert = `-----BEGIN CERTIFICATE-----

Note: I will be happy to implement this change once we agree on the process for doing so.

https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL-certificate-rotation.html

@gramidt gramidt changed the title RDS root certificates must be changed by 3/5/2020 RDS root certificates must be updated by 3/5/2020 Oct 11, 2019
@irbekrm
Copy link
Contributor

irbekrm commented Nov 4, 2019

Hey @gramidt, thank you very much for raising this issue, this is much appreciated.

At the moment we are creating the RDS database using Terraform here and by default AWS RDS instances are still created with the old cert (as described in the docs you linked).
I see that there is some work in progress towards adding an extra argument to the aws_db_instance Terraform resource that will allow to specify which AWS certificate to use hashicorp/terraform-provider-aws#10490. Using this argument seems like a good way to test creation of databases with the new certificate before it becomes default.

Then we will probably need to have a discussion about how to test this, especially on existing control-tower deployments with the old certificate.

@irbekrm
Copy link
Contributor

irbekrm commented Nov 18, 2019

I have added a story in our backlog to update the cert.

@DanielJonesEB
Copy link
Contributor

Thanks for raising this @gramidt, I'd been dutifully ignoring the many emails from AWS :)

Fixed in ee3dbde, now working on cutting a release.

@gramidt
Copy link
Contributor Author

gramidt commented Jan 11, 2020

Thank you so much, @irbekrm and @DanielJonesEB!

I apologize for the delayed response, but I am very glad you two were able to get this resolved.

Have a great rest of your weekend!

@irbekrm
Copy link
Contributor

irbekrm commented Jul 21, 2020

Closing this as it has now been resolved.

Thanks for your help, @gramidt !

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants