AWS RDS database instance not configured with encryption in transit
This policy identifies AWS RDS database instances that are not configured with encryption in transit. This covers MySQL, SQL Server, PostgreSQL, MariaDB, and DB2 RDS instances.

Enabling encryption is crucial to protect data as it moves through the network and enhances the security between clients and storage servers. Without encryption, sensitive data transmitted between your application and the database is vulnerable to interception by malicious actors. This could lead to unauthorized access, data breaches, and potential compromises of confidential information.

It is recommended that data be encrypted while in transit to ensure its security and reduce the risk of unauthorized access or data breaches.
This is applicable to aws cloud and is considered a medium severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: To enable the in-transit encryption feature for your Amazon RDS databases, perform the following actions:

Default parameter groups for RDS DB instances cannot be modified. Therefore, you must create a custom parameter group, modify it, and then attach it to your RDS for DB instances. Changes to parameters in a customer-created DB parameter group are applied to all DB instances that are associated with the DB parameter group.

Follow the below links to create and associate a DB parameter group with a DB instance,

To Create a DB parameter group, refer to the below link
https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithDBInstanceParamGroups.html#USER_WorkingWithParamGroups.Creating

To Associating a DB parameter group with a DB instance, refer the below link
https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithDBInstanceParamGroups.html#USER_WorkingWithParamGroups.Associating

To Modifying parameters in a DB parameter group,

1. Sign in to the AWS Management Console and open the Amazon RDS console at https://console.aws.amazon.com/rds/.
2. In the navigation pane, choose 'Parameter Groups'.
3. In the list, choose the parameter group that is associated with the RDS instance.
4. For Parameter group actions, choose 'Edit'.
5. Change the values of the parameters that you want to modify. You can scroll through the parameters using the arrow keys at the top right of the dialog box.
6. In the 'Modifiable parameters' section, enter 'rds.force_ssl' in the Filter Parameters search box for SQL Server and PostgreSQL  databases, and type 'require_secure_transport' in the search box for MySQL and MariaDB databases and type DB2COMM for DB2 databases.
 a. For the 'rds.force_ssl' database parameter, enter '1' in the Value configuration box to enable the Transport Encryption feature. 
  or
    b. For the 'require_secure_transport' parameter, enter '1' in the Value configuration box to enable the Transport Encryption feature.
    or
    c. For the 'DB2COMM' parameter, enter 'SSL' in the Value box based on the allowed values to enable Transport Encryption.
7. Choose Save changes..

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-rds-describe-db-instances' as X; config from cloud.resource where api.name = 'aws-rds-describe-db-parameter-groups' AND json.rule = (((dbparameterGroupFamily starts with "postgres" or dbparameterGroupFamily contains "sqlserver") and (['parameters'].['rds.force_ssl'].['parameterValue'] does not equal 1 or ['parameters'].['rds.force_ssl'].['parameterValue'] does not exist)) or ((dbparameterGroupFamily starts with "mariadb" or dbparameterGroupFamily starts with "mysql") and (parameters.require_secure_transport.parameterValue does not equal 1 or parameters.require_secure_transport.parameterValue does not exist)) or (dbparameterGroupFamily contains "db2-ae" and (parameters.db2comm.parameterValue does not equal ignore case "SSL" or parameters.db2comm.parameterValue does not exist))) as Y; filter '$.X.dbparameterGroups[*].dbparameterGroupArn equals $.Y.dbparameterGroupArn' ; show X;```