Rule: RDS Databases Must Not Use Database Engine Default Port

Rule Description:

Troubleshooting Steps:

2. 1.
   Identify the database instances or clusters that are using the default port.
4. 2.
   Check the current port configuration for each identified instance or cluster.
6. 3.
   Determine if there are any dependencies or requirements for the database engine to use the default port.
8. 4.
   Evaluate the potential risks associated with changing the port and consider alternative security controls to mitigate those risks if necessary.
10. 5.
    Plan and schedule the port change during a maintenance window or low-traffic period to minimize disruption.

Necessary Codes:

Step-by-Step Guide for Remediation:

2. 1.

   Log in to the AWS Management Console and navigate to the RDS service.

4. 2.

   Select the region where your RDS instances or clusters are located.

6. 3.

   Identify the specific RDS instances or clusters that are using the default port.

8. 4.

   Determine the current port configuration for each identified instance or cluster.

10. 5.

    Consult the documentation and support resources for the specific database engine you are using to understand the impact and implications of changing the port.

12. 6.

    If necessary, create a backup or snapshot of the database instances or clusters to ensure data integrity.

14. 7.

    Plan and schedule a maintenance window or low-traffic period for the port change.

16. 8.

    Modify the port configuration for each identified instance or cluster using one of the following methods:

    a. AWS Management Console: i. Select the instance or cluster and click on "Modify" or "Edit" button. ii. Locate the "Port" or "Endpoint" field and enter the desired non-default port number. iii. Save the changes and wait for the modification process to complete.

    b. AWS CLI: i. Open the AWS CLI or AWS CLI tools such as AWS CloudShell. ii. Run the following command to modify the port for a specific RDS instance:

          aws rds modify-db-instance --db-instance-identifier <instance-id> --vpc-security-group-ids <security-group-ids> --apply-immediately --port <port-number>      

    Replace

    <instance-id>

    with the identifier of the RDS instance and

    <port-number>

    with the desired non-default port.

    c. AWS SDKs: i. Use the appropriate SDK for your preferred programming language to modify the port configuration programmatically.

18. 9.

    Once the modification is completed, verify that the RDS instances or clusters are accessible through the new port.

20. 10.

    Update any relevant configurations or applications that connect to the RDS instances or clusters to reflect the new port number.

22. 11.

    Perform thorough testing to ensure that all functionalities dependent on the RDS instances or clusters are working correctly.

24. 12.

    Monitor the database instances or clusters for any issues or anomalies after the port change.