Lambda to RDS PG SSL Communication: handling AWS certificates rotation programmatically

Question

AWS RDS rotates the certificates that require updating the client's trust store with a new CA certificate. What is the standard approach for updating CA certificate in the client application dynamically/programmatically without any manual intervention ensuring no impact on incoming traffic? Pls, note downloading the CA certificate should also happen programmatically.

I tried searching for this information on the AWS document but couldn't find it, everywhere it's mentioned to download the CA bundle manually (as the link may not be fixed) which may not be ideal for a production-grade setup.

Answer

AHA dashboard should be able to provide the scheduled account notifications w.r.t RDS cert rotation. A workaround could be to build automation around AHA notifications and subscribe for these events as mentioned in blog post architecture - https://aws.amazon.com/blogs/mt/aws-health-aware-customize-aws-health-alerts-for-organizational-and-personal-aws-accounts/
Once a Lambda is able to process the cert rotation operation from above architecture, downloading the new CA cert and updating the client application trust store could be done programmatically as provided in docs - https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL-certificate-rotation.html#UsingWithRDS.SSL-certificate-rotation-sample-script
Hope it helps.

Answer

Certificates in lambda for mtls usually can be configured using lambda layers. Trust stores could be added to  lambda layers in similar approach. Please refer to this sample if its useful for your case - https://github.com/aws-samples/serverless-mutual-tls/blob/main/README.md

Answer

For a Lambda, you should consider using an IAM role to allow access rather than Certificate.  The certificate is better suited for clients.

Lambda to RDS PG SSL Communication: handling AWS certificates rotation programmatically

Relevant content