Rule: RDS DB Instances Should Prohibit Public Access

Rule Description

Troubleshooting Steps

Step 1: Verify the RDS DB instance's network settings

2. 1.
   Go to the AWS Management Console and open the Amazon RDS service.
4. 2.
   Select the appropriate region.
6. 3.
   Click on "Databases" in the left sidebar.
8. 4.
   Identify the RDS DB instance(s) you want to review.
10. 5.
    Click on the DB instance name to view its details.

Step 2: Check the security group associated with the RDS DB instance

2. 1.
   In the RDS instance details page, go to the "Connectivity & security" tab.
4. 2.
   Under "Security" section, locate the security group associated with the RDS DB instance.
6. 3.
   Note down the security group name for further troubleshooting.

Step 3: Review the security group settings

2. 1.
   Open the Amazon VPC service in the AWS Management Console.
4. 2.
   Select the appropriate region.
6. 3.
   Click on "Security Groups" in the left sidebar.
8. 4.
   Locate and select the security group identified in the previous step.
10. 5.
    Review the inbound and outbound rules defined for the security group.

Step 4: Ensure there are no public access rules

2. 1.
   In the selected security group, review the inbound rules.
4. 2.
   Ensure that there are no rules allowing traffic from 0.0.0.0/0 or specific public IP ranges.
6. 3.
   If any public access rules are found, delete or modify them accordingly.

Step 5: Verify the accessibility of the RDS DB instance

2. 1.
   Access the RDS DB instance using appropriate methods such as connecting to it with a database client or application.
4. 2.
   Confirm that the RDS DB instance is not accessible publicly.
6. 3.
   Ensure that only authorized users and resources can connect to the RDS DB instance.

Code Samples

Remediation Steps

2. 1.
   Go to the AWS Management Console and open the Amazon RDS service.
4. 2.
   Select the appropriate region.
6. 3.
   Click on "Databases" in the left sidebar.
8. 4.
   Identify the RDS DB instance(s) you want to update.
10. 5.
    Click on the DB instance name to view its details.
12. 6.
    In the instance details page, go to the "Connectivity & security" tab.
14. 7.
    Under the "Security" section, click on the associated security group.
16. 8.
    In the security group details page, review the inbound rules.
18. 9.
    Remove any rules allowing public access, such as those with source IP of 0.0.0.0/0 or specific public IP ranges.
20. 10.
    Save the changes.
22. 11.
    Verify the accessibility of the RDS DB instance to ensure it is not accessible publicly.
24. 12.
    Ensure that only authorized users and resources can connect to the RDS DB instance.