Rule: RDS DB Instances Prohibit Public Access

Rule Description:

Troubleshooting Steps:

2. 1.

   Verify the Security Group configuration:

   • Check if the inbound rules allow access from any IP addresses (0.0.0.0/0).
   • Ensure that no rule allows access from any source IP or public IP ranges.
4. 2.

   Check the Subnet Group settings:

   • Validate that the RDS DB instances are not assigned to a public subnet.
   • Ensure that the DB instances are located within a private subnet.
6. 3.

   Verify the instance's parameter group configuration:

   • Check if the

     publicly_accessible

     parameter is set to

     false

     .
   • Ensure that the DB instance does not have any other parameter allowing public access.
8. 4.

   Validate the Network Access Control Lists (NACLs) settings:

   • Ensure that the inbound and outbound rules for the associated subnets do not permit public access.

Rule Remediation:

2. 1.

   Identify the RDS DB instances that allow public access:

   • List all existing RDS DB instances within your AWS infrastructure.
4. 2.

   Modify the security group associated with the problematic RDS DB instance(s):

   • Access the AWS Management Console.
   • Go to the EC2 service and navigate to the "Security Groups" section.
   • Search for the security group associated with the problematic RDS DB instance(s).
   • Edit the security group's inbound rules to restrict access by modifying the source IP or IP range allowed. Ideally, restrict it to specific IP addresses or CIDR blocks that require access.
6. 3.

   Move the RDS DB instance(s) to a private subnet:

   • Go to the RDS service within the AWS Management Console.
   • Select the RDS DB instance(s) that allow public access.
   • Click "Modify" and choose the appropriate private subnet from the "Virtual Private Cloud (VPC) settings" options.
   • Save the changes to move the RDS DB instance(s) to a private subnet.
8. 4.

   Update the instance's parameter group settings:

   • Within the RDS service, click on the "Parameter Groups" tab.
   • Select the appropriate parameter group associated with the RDS DB instance.
   • Modify the

     publicly_accessible

     parameter and set it to

     false

     .
   • Save the changes to update the parameter group settings.
10. 5.

    Validate the Network Access Control Lists (NACLs):

    • Go to the VPC service within the AWS Management Console.
    • Navigate to the "Network ACLs" section.
    • Identify the Network ACL associated with the subnets that contain the RDS DB instances.
    • Ensure that the inbound and outbound rules do not permit public access.
    • Modify the Network ACL rules if needed to restrict public access.
12. 6.

    Monitor and validate the changes:

    • Regularly review the RDS DB instances to ensure public access is restricted.
    • Monitor the associated security groups, parameter groups, and Network ACLs to detect any unauthorized changes.

Additional Notes: