Detections
Analytics

2.2.3 Ensure that RDS instances are not publicly accessible

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Ensure and verify that the RDS database instances provisioned in your AWS account restrict unauthorized access in order to minimize security risks. To restrict access to any RDS database instance, you must disable the Publicly Accessible flag for the database and update the VPC security group associated with the instance.

Ensure that no public-facing RDS database instances are provisioned in your AWS account, and restrict unauthorized access in order to minimize security risks. When the RDS instance allows unrestricted access (0.0.0.0/0), anyone and anything on the Internet can establish a connection to your database, which can increase the opportunity for malicious activities such as brute force attacks, PostgreSQL injections, or DoS/DDoS attacks.

Solution

From Console:

 - Log in to the AWS management console and navigate to the RDS dashboard at

https://console.aws.amazon.com/rds/

.
 - Under the navigation panel, on the RDS dashboard, click Databases
 - Select the RDS instance that you want to update.
 - Click Modify from the dashboard top menu.
 - On the Modify DB Instance panel, under the Connectivity section, click on Additional connectivity configuration and update the value for Publicly Accessible to Not publicly accessible to restrict public access.
 - Follow the below steps to update subnet configurations:

 - Select the Connectivity and security tab, and click the VPC attribute value inside the Networking section.
 - Select the Details tab from the VPC dashboard's bottom panel and click the Route table configuration attribute value.
 - On the Route table details page, select the Routes tab from the dashboard's bottom panel and click Edit routes
 - On the Edit routes page, update the Destination of Target which is set to igw-xxxxx and click Save routes.

<xhtml:ol start="7"> - On the Modify DB Instance panel, click Continue and in the Scheduling of modifications section, perform one of the following actions based on your requirements:

 - Select Apply during the next scheduled maintenance window to apply the changes automatically during the next scheduled maintenance window.
 - Select Apply immediately to apply the changes right away. With this option, any pending modifications will be asynchronously applied as soon as possible, regardless of the maintenance window setting for this RDS database instance. Note that any changes available in the pending modifications queue are also applied. If any of the pending modifications require downtime, choosing this option can cause unexpected downtime for the application.

<xhtml:ol start="8"> - Repeat steps 3-7 for each RDS instance in the current region.
 - Change the AWS region from the navigation bar to repeat the process for other regions.

From Command Line:

 - Run the describe-db-instances command to list all available RDS database identifiers in the selected AWS region:

aws rds describe-db-instances --region <region-name> --query 'DBInstances[*].DBInstanceIdentifier' <xhtml:ol start="2"> - The command output should return each database instance identifier.
 - Run the modify-db-instance command to modify the configuration of a selected RDS instance, disabling the Publicly Accessible flag for that instance. This command uses the apply-immediately flag. If you want to avoid any downtime, the --no-apply-immediately flag can be used:

aws rds modify-db-instance --region <region-name> --db-instance-identifier <db-instance-name> --no-publicly-accessible --apply-immediately <xhtml:ol start="4"> - The command output should reveal the PubliclyAccessible configuration under pending values, to be applied at the specified time.
 - Updating the Internet Gateway destination via the AWS CLI is not currently supported. To update information about the Internet Gateway, please use the AWS Console procedure.
 - Repeat steps 1-5 for each RDS instance provisioned in the current region.
 - Change the AWS region by using the --region filter to repeat the process for other regions.

See Also

https://workbench.cisecurity.org/benchmarks/19631

Item Details

References: CSCv7|14.6

Plugin: amazon_aws

Control ID: 508bc7958c16e4520e2c894c78fc1c9826d19a8639ae847f8909fb49489b8cd9