Rule: RDS DB Instances Should Prohibit Public Access
This rule enforces prohibiting public access to RDS DB instances to enhance security measures.
| Rule | RDS DB instances should prohibit public access |
| Framework | HIPAA |
| Severity | ✔ High |
RDS DB Instances Should Prohibit Public Access for HIPAA Compliance
The Health Insurance Portability and Accountability Act (HIPAA) sets the standard for protecting sensitive patient data. Any company that deals with protected health information (PHI) must ensure that all required security measures are in place, including safeguarding data from unauthorized access. For Amazon RDS database instances that may contain PHI, it's essential to prohibit public access to ensure compliance with HIPAA.
Description of the Policy
The policy of prohibiting public access to RDS DB instances for HIPAA compliance involves ensuring that the database instances are not publicly accessible and are accessible only within a controlled environment, like a virtual private cloud (VPC). This policy helps in reducing the risk of exposing PHI to unauthorized entities.
Troubleshooting Steps for Compliance Verification
If you suspect that an RDS instance is publicly accessible and thus non-compliant with HIPAA, follow these steps:
- 1.
Check the Instance's Public Accessibility Setting:
- Use the AWS Management Console or the AWS CLI to examine the 'PubliclyAccessible' attribute of the RDS instance. It should be set to
.false
- 2.
Review Security Group Rules:
- Investigate the associated security group rules. There should be no rules allowing inbound traffic from
(representing all IPv4 addresses).0.0.0.0/0
- 3.
Audit Network Configurations:
- Ensure that the subnet for the RDS instance is part of a VPC with appropriate network access control lists (ACLs) and routing rules that restrict public access.
Remediation Steps
If an RDS DB instance is currently set to allow public access, follow these remediation steps to achieve HIPAA compliance:
- 1.
Modify the RDS Instance:
Utilize the AWS CLI command to modify the RDS instance to ensure it's no longer publicly accessible:
aws rds modify-db-instance \ --db-instance-identifier [your-instance-identifier] \ --no-publicly-accessible \ --apply-immediatelyReplace
with your actual DB instance identifier.[your-instance-identifier] - 2.
Update Security Group Rules:
Use the AWS CLI or Management Console to update the security group. Remove any inbound rules that allow traffic from
.0.0.0.0/0 - 3.
Modify Network ACLs and Subnet Associations:
Ensure the subnet associated with the RDS instance is not set to allow public access, and update the network ACLs to prevent inbound and outbound traffic from unauthorized networks.
By following these steps accurately, you'll disable public access to your RDS DB instances and take a significant step towards HIPAA compliance. Regularly audit and monitor your AWS environment to maintain compliance and quickly address any deviations.
Additional Notes
- Always keep backups and test the changes in a staging environment before applying them to production.
- Document your compliance efforts and maintain logs for auditing purposes.
- If you're unfamiliar with the AWS CLI or networking, consult with a certified AWS professional.
Ensuring your AWS RDS DB instances are not publicly accessible is critical for HIPAA compliance. By following these steps, you enhance the security of sensitive data and protect against unauthorized access.