Adding SSL/TLS to an Existing MySQL App (EC2 + Lambda)

When you're applying SSL/TLS encryption first time to your already existing application (EC2 code and Lambda code), 3 steps involve:

1. Client says: encrypt + verify the server cert (verify_cert + verify_identity).
2. Both need the provider's CA bundle file to verify against.
3. Server-side: reject non-SSL connections — last, once every client is on TLS.

1. Get the CA bundle

Public file, not a secret. Commit it.

curl -sS -o certs/global-bundle.pem \
  https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem

2. EC2 code (ORM)

SSL goes in connect_args. Pool settings stay as-is.

engine = create_engine(
    DATABASE_URL,
    connect_args={
        "ssl_ca": os.getenv("DB_SSL_CA", "/app/certs/global-bundle.pem"),
        "ssl_verify_cert": True,
        "ssl_verify_identity": True,
    },
    pool_size=POOL_SIZE, pool_pre_ping=True,
)

Deliver the cert to the server as part of your deploy (e.g. copy it to /app/certs).

3. Lambda code (raw driver)

Same three args on every connect():

CA_PATH = os.getenv("DB_SSL_CA", "/opt/certs/global-bundle.pem")

pymysql.connect(
    ssl_ca=CA_PATH, ssl_verify_cert=True, ssl_verify_identity=True,
    host=..., user=..., password=..., database=...,
)

Ship the cert to Lambda as a layer, which can be used as one artifact for all functions. A layer extracts under /opt, so a file zipped at certs/global-bundle.pem becomes /opt/certs/global-bundle.pem:

Attach the layer, then the code already defaults to that path, no env var needed.

4. Verify → then enforce

Check a live connection is actually encrypted:

SHOW STATUS LIKE 'Ssl_cipher';   -- empty = plaintext; TLS_AES_256_GCM_SHA384 = good

Then enforce server-side — only after every client is verified, one environment at a time:

require_secure_transport = ON;        -- or: ALTER USER 'app'@'%' REQUIRE SSL;