Rule: RDS Snapshots Should Prohibit Public Access
This rule ensures RDS snapshots are secured by prohibiting public access.
| Rule | RDS snapshots should prohibit public access |
| Framework | NIST 800-53 Revision 5 |
| Severity | ✔ Critical |
Rule Description
This rule ensures that RDS snapshots in AWS do not have public access, which aligns with the NIST 800-53 Revision 5 security control recommendations. Publicly accessible RDS snapshots may expose sensitive data to unauthorized users, leading to potential security breaches.
Troubleshooting Steps
In case you encounter issues related to public access for RDS snapshots, consider following these troubleshooting steps:
- 1.Verify Permissions: Check the permissions associated with the RDS snapshot. Ensure that the appropriate user or role has been granted the required permissions to access and modify the snapshot settings.
- 2.Network Configuration: Review the networking configuration of the Amazon RDS instance associated with the snapshot. Ensure that it is not publicly accessible and is within a private subnet.
- 3.Security Group Settings: Examine the security group rules associated with the RDS instance. Ensure that inbound rules are set to allow access only from trusted sources and prohibit public access.
- 4.VPC Configuration: Validate the VPC settings, ensuring that there are no subnets or route tables that allow public internet access to the RDS instance.
- 5.AWS Resource Policies: Check if there are any resource policies in place that may override the security group settings and allow public access. Identify and modify those policies as needed.
Necessary Codes
No specific codes are required for this rule. However, you may need to use AWS CLI commands to verify and modify the settings for RDS snapshots and associated resources.
Remediation Steps
Follow these step-by-step instructions to remediate the public access issue for RDS snapshots:
- 1.
Identify the RDS snapshot: Determine the specific RDS snapshot that needs to have public access prohibited.
- 2.
Modify the snapshot's permissions:
- Open the Amazon RDS console.
- Select the appropriate AWS Region.
- Click on "Snapshots" in the left navigation panel.
- Find the target snapshot from the list and click on its identifier.
- In the snapshot details page, click on the "Modify Permissions" button.
- Ensure that "Public" is not selected in the "Access type" dropdown menu.
- Click "Save" to apply the changes.
- 3.
Verify changes:
- Refresh the snapshots page or revisit the details page of the modified snapshot.
- Ensure that there is no public access allowed for the snapshot.
- 4.
Review associated resources:
- Check the security group settings of the RDS instance associated with the snapshot.
- Ensure that there are no inbound rules allowing public access.
- Modify the security group rules if necessary.
- 5.
Repeat for other affected snapshots:
- If there are multiple RDS snapshots with the public access issue, repeat steps 1-4 for each snapshot.
By following these steps, you can ensure that RDS snapshots prohibit public access and comply with the NIST 800-53 Revision 5 security control recommendations.