TLS 1.2 + Aurora Serverless MySql

Question

My customer is currently using Aurora Mysql 5.7 to benefit from TLS 1.2 support, as the MySql v5.6 was limited to TLS v1.

They would like to switch to Aurora Serverless, along with MySql compatibilty.
Doing so, the latest MySql version they are able to pick up with Serverless is "Aurora (MySql)-5.6.10a". Everything beyond that is not available as Serverless.

Now straight to the question:  the Aurora Serverless documentation states that it supports TLS v1.0, 1.1 and 1.2 (https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-serverless.html#aurora-serverless.tls). Is it the case whatever MySql engine compatibility is picked up?  
To reformulate: if I pick classic Aurora Mysql 5.6, I don't have TLS 1.2 support. If I pick up Aurora Serverless MySql 5.6, will I have TLS 1.2 support?

Thanks for your help

Accepted Answer

Aurora Serverless connectivity is handled differently from provisioned Aurora. While Aurora provisioned/RDS uses a manual certificate provisioning, which is directly installed on the database, Aurora serverless uses a fleet of proxy combined with ACM. This may explain the differences of support in TLS version.

So in summary,

* Provisioned Aurora MySQL 5.6 only [supports TLS version 1.0](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Security.html).  
* Provisioned Aurora MySQL 5.7 [supports TLS version 1.0, 1.1, and 1.2](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Security.html).  
* Aurora Serverless [supports TLS version 1.0, 1.1, and 1.2](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-serverless.html#aurora-serverless.tls).

Hope this helps.

Thanks,  
-Aditya

TLS 1.2 + Aurora Serverless MySql

Contenido relevante