0

I am building an application using AWS Lambda and using a MongoDB database hosted directly with MongoDB (Atlas). For some reason, I get an error when trying to connect via SSL and I've been working on it for days without any luck.

What are the risks, I mean real-world risks including scenarios, of using a non-secure connection when connecting to the database?

I guess in theory it's open to man-in-the-middle and if the connection is intercepted somehow they could read the contents of the request, but how would this work practically between AWS Lambda and MongoDB Atlas (hosted within AWS)? Someone would have to have some form of access to the network in order to eavesdrop wouldn't they?

  • What you have described is not an "externally hosted database" if both are in AWS. – schroeder Feb 17 at 16:12
  • Your question becomes about the threats within the AWS network. And that's a bit of an unknown. – schroeder Feb 17 at 16:13
  • Disclosure is not the only threat if the threat actor is malicious: a malicious threat actor could change the data, as well. – schroeder Feb 17 at 16:14
  • They both utilise AWS but MongoDB manage their databases through their own AWS account and I must access it through a separate host URL which is accessible by anyone (I will try and lock this down to AWS specific IP addresses but obviously within AWS the ip address changes) – Adam Lewis Feb 17 at 16:16
  • Sure, I get that, but the traffic is not leaving AWS. That means the threat has to be within AWS networks. – schroeder Feb 17 at 16:17
0

As a good practice, the connection between the Server and Database should always be over SSL, whether the network/connection is exposed to the extra world or not. In this case, there could an MITM attack by the person having access to the network. Just remember the principles like 'Segregation of Duties (SoD)', 'Need to Know' and 'Need to Have'. Unauthorized should never have access to confidential information.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.