Is SSL on AWS RDS in private network necessary

Question

I saw that using SSL on AWS RDS can reduce the performance of the database by over 10%. Let's say that an RDS database is on a private network and only accessed by applications on other private networks in the same VPC. The security groups of the database allow only inbound rules from the security groups of these applications. Also, the NACL's allow only the appropriate traffic flow between the subnets. These applications are fronted by an application load balancer and therefore also on a private subnet. Would not using SSL for connections to the database impose a security risk? What are the benefits of enforcing SSL connections in this scenario?

Answer 1

Necessity is dependent on governance and/or your appetite for risk.

From a risk appetite perspective, using Risk == Threat * Vulnerability, if you don't encrypt data in motion you're increasing your vulnerability and by inference you're going to increase your risk. Depending on your level of threat, this variance in vulnerability could change your risk very little, or change it greatly.

From a governance perspective, if you're doing work in HiTECH or FedRAMP you must encrypt data in motion. Other governance can be more vague on the requirement. So yes, it could be necessary to use SSL to access your RDS database.

Based on the use case above, I could go either way. I'd look at my compensating controls and how my defense in depth is setup to make this decision.