AWS – "SQL Server TLS Version" Is Inescapable

The test for "SQL Server TLS Version" picks up default RDS DB Parameter Groups. These DB Parameter Groups cannot be deleted or modified. This means that ever having used SQL Server in the past – even if that use was associated with a different, more secure DB Parameter Group – will cause this scan to fail forever.

I imagine it would be better to scan for DB Parameters Groups which are _in-use_, rather than simply _present_. It appears this can be done by:

- Enumerating DB Instances
- Filtering on DB Engine's starting with 'sqlserver'
- Enumerating the DB Parameter Groups therein
- Selecting the DB Parameter Group Name

…which names can be used as the inputs to the existing parameter value checking.

Start with the implementation of the AWS "SQL Server TLS Version" check and trace how it discovers DB Parameter Groups. Read the RDS DB instance and parameter-group enumeration paths, then verify the check uses only in-use groups for SQL Server engines while preserving the existing parameter-value validation.

Written by the indexing model from the issue text.