AWS RDS cluster encryption in transit is not configured
This policy identifies AWS RDS database clusters that are not configured with encryption in transit. This covers MySQL, PostgreSQL, and Aurora clusters.

Enabling encryption is crucial to protect data as it moves through the network and enhances the security between clients and storage servers. Without encryption, sensitive data transmitted between your application and the database is vulnerable to interception by malicious actors. This could lead to unauthorized access, data breaches, and potential compromises of confidential information.

It is recommended that data be encrypted while in transit to ensure its security and reduce the risk of unauthorized access or data breaches.
This is applicable to aws cloud and is considered a medium severity issue.
Sample categories of findings relevant here are ['UNENCRYPTED_DATA'].
Mitigation of this issue can be done as follows: To enable the in-transit encryption feature for your Amazon RDS cluster, perform the following actions:
Default cluster parameter groups for RDS DB clusters cannot be modified. Therefore, you must create a custom parameter group, modify it, and then attach it to your RDS for Cluster. Changes to parameters in a customer-created DB cluster parameter group are applied to all DB clusters that are associated with the DB cluster parameter group.
Follow the below links to create and associate a DB parameter group with a DB cluster,
To Create a DB cluster parameter group, refer to the below link
https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithDBClusterParamGroups.html#USER_WorkingWithParamGroups.CreatingCluster
To Modifying parameters in a DB cluster parameter group,
1. Sign in to the AWS Management Console and open the Amazon RDS console at https://console.aws.amazon.com/rds/.
2. In the navigation pane, choose 'Parameter Groups'.
3. In the list, choose the parameter group that is associated with the reported RDS DB Cluster.
4. For Parameter group actions, choose 'Edit'.
5. Change the values of the parameters that you want to modify. You can scroll through the parameters using the arrow keys at the top right of the dialog box.
6. In the 'Modifiable parameters' section, enter 'rds.force_ssl' in the Filter Parameters search box for PostgreSQL and Aurora PostgreSQL databases, and type 'require_secure_transport' in the search box for MySQL and Aurora MySQL databases.
 a. For the 'rds.force_ssl' database parameter, enter '1' in the Value configuration box to enable the Transport Encryption feature. 
  or
    b. For the 'require_secure_transport' parameter, enter '1' for MySQL Databases or 'ON' for Aurora MySQL databases based on allowed values in the Value configuration box  to enable the Transport Encryption feature.
7. Choose Save changes.
8. Reboot the primary (writer) DB instance in the cluster to apply the changes to it.
9. Then reboot the reader DB instances to apply the changes to them..

Query:
```config from cloud.resource where api.name = 'aws-rds-db-cluster' as X; config from cloud.resource where api.name = 'aws-rds-db-cluster-parameter-group' AND json.rule = (((DBParameterGroupFamily starts with "postgres" or DBParameterGroupFamily starts with "aurora-postgresql") and (['parameters'].['rds.force_ssl'].['ParameterValue'] does not equal 1 or ['parameters'].['rds.force_ssl'].['ParameterValue'] does not exist)) or ((DBParameterGroupFamily starts with "aurora-mysql" or DBParameterGroupFamily starts with "mysql") and (parameters.require_secure_transport.ParameterValue is not member of ("ON", "1") or parameters.require_secure_transport.ParameterValue does not exist))) as Y; filter '$.X.dBclusterParameterGroupArn equals $.Y.DBClusterParameterGroupArn' ; show X;```