feat(cloudquery): Verify RDS SSL certificate

[akash1810]

What does this change?

Verify the full SSL certificate on the RDS connection.

To achieve this, we download and add the signing certificate authority (CA) to the OS trust store. This means the CA is trusted OS wide.

An alternative to this could be to set the sslrootcert value in the postgres connection string. Opted against that because it means we have to remember a file path, which is fragile. For example, when we move to an AMIgo recipe, we'd need to ensure these two paths line up, and stay in sync.

Why?

Security!

From https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html:

You can use Secure Socket Layer (SSL) or Transport Layer Security (TLS) from your application to encrypt a connection to a DB instance running MariaDB, Microsoft SQL Server, MySQL, Oracle, or PostgreSQL.

SSL/TLS connections provide one layer of security by encrypting data that moves between your client and a DB instance. Using a server certificate provides an extra layer of security by validating that the connection is being made to an Amazon RDS DB instance. It does so by checking the server certificate that is automatically installed on all DB instances that you provision.

How has it been verified?

• Deploy it (done)
• Start cloudquery (sudo systemctl start cloudquery)
• Observe the logs showing postgres is being written to (sudo journalctl -f -u cloudquery OR look in Central ELK)

[akash1810]

Followed instructions from https://superuser.com/a/719047 to add the CA to the OS.

[akash1810]

The rds-ca-2019 certificate authority expires in 2024, and does not support automatic rotation, meaning we'll have to perform the rotation manually (with potential downtime).

We should move to the rds-ca-rsa2048-g1 CA, which does support automatic rotation.

See:

• https://aws.amazon.com/about-aws/whats-new/2023/01/amazon-rds-new-ssl-tls-certificates-certificate-controls/
• https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html#UsingWithRDS.SSL.RegionCertificateAuthorities

[NovemberTang]

do we have a ticket planned to do this migration?

[akash1810]

do we have a ticket planned to do this migration?

Not (yet) on trello, but we do have guardian/cdk#1786.

[akash1810]

Created the Trello card now - https://trello.com/c/gqPcnFh7.