Login

Cloud Defense Logo

Products

Solutions

Company

Book A Live Demo

Rule: RDS DB Instances IAM Authentication Enabled

Ensure IAM authentication is enabled for RDS DB instances.

RuleRDS DB instances should have iam authentication enabled
FrameworkSOC 2
Severity
✔
Medium

Enabling IAM Authentication for RDS DB Instances for SOC 2 Compliance

Understanding IAM Authentication for RDS

IAM authentication enables authentication to database instances using AWS Identity and Access Management (IAM) credentials. For RDS instances running MySQL, PostgreSQL, and Amazon Aurora, it offers an alternative to conventional username/password authentication.

Benefits of IAM Authentication

  2. 1.
    Centralized management of database credentials.
  4. 2.
    Leverages IAM policies for access control.
  6. 3.
    Meets compliance requirements such as SOC 2.

Prerequisites

  • An AWS account with required permissions.
  • Existing RDS DB instance or the capability to create one.
  • Basic understanding of AWS IAM and RDS services.

Step 1: Enable IAM Authentication for RDS DB Instance

Via AWS Management Console

  2. 1.
    Open the Amazon RDS console at https://console.aws.amazon.com/rds/.
  4. 2.
    In the navigation pane, choose Databases.
  6. 3.
    Select the DB instance you want to modify.
  8. 4.
    Choose Modify.
  10. 5.
    In the Database options section, for IAM DB authentication, select Enable.
  12. 6.
    Choose Continue and then select Modify DB Instance.

Via AWS CLI

Execute the following AWS CLI command to modify the instance to use IAM authentication:

aws rds modify-db-instance \
    --db-instance-identifier <db-instance-identifier> \
    --enable-iam-database-authentication \
    --apply-immediately

Replace 

<db-instance-identifier>
with the actual DB instance identifier.

Step 2: Create IAM Policy for Database Access

Create an IAM policy that grants the necessary permissions to authenticate with the RDS instance.

Via AWS Management Console

  2. 1.
    Open the IAM console at https://console.aws.amazon.com/iam/.
  4. 2.
    Navigate to Policies and choose Create Policy.
  6. 3.
    Select the JSON tab and enter the policy:
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "rds-db:connect"
      ],
      "Resource": [
        "arn:aws:rds-db:region:accountId:dbuser:dbi-resource-id/dbuserName"
      ]
    }
  ]
}
  2. 1.
    Replace 
    region
    , 
    accountId
    , 
    dbi-resource-id
    , and 
    dbuserName
    with your specific details.
  4. 2.
    Click Review policy, name your policy, and create.

Via AWS CLI

Use the following command to create a new IAM policy:

aws iam create-policy \
    --policy-name RDSIAMAuthPolicy \
    --policy-document file://rds-auth-policy.json

Ensure 

rds-auth-policy.json
contains the necessary policy JSON from above.

Step 3: Attach IAM Policy to IAM User or Group

Once the policy is created, attach it to the IAM user or group that requires access to the RDS DB instance.

Via AWS Management Console

  2. 1.
    Navigate to Users or Groups in the IAM console.
  4. 2.
    Select the user or group to attach the policy.
  6. 3.
    Go to Permissions and choose Add permissions.
  8. 4.
    Attach the policy created in Step 2.

Via AWS CLI

To attach the policy to a user, use:

aws iam attach-user-policy \
    --policy-arn <policy-arn> \
    --user-name <user-name>

To attach to a group:

aws iam attach-group-policy \
    --policy-arn <policy-arn> \
    --group-name <group-name>

Replace 

<policy-arn>
, 
<user-name>
, and 
<group-name>
with the appropriate values.

Step 4: Enable Network Access to RDS Instance

Ensure the RDS instance is accessible from the network from which the IAM users will connect.

  2. 1.
    Update security group rules to allow inbound traffic.
  4. 2.
    Configure VPC and subnets if necessary.

Troubleshooting Steps

IAM Authentication Not Working

  2. 1.
    Verify the RDS instance has IAM authentication enabled.
  4. 2.
    Check the associated IAM policy has the correct permissions.
  6. 3.
    Confirm the user attempting to connect has the IAM policy attached.
  8. 4.
    Ensure the RDS security group allows connections from the user's IP address.

Unable to Attach IAM Policy

  2. 1.
    Confirm sufficient permissions to modify IAM policies.
  4. 2.
    Ensure the policy JSON syntax is correct and valid.

By following these steps and troubleshooting guidelines, IAM Authentication can be enabled for AWS RDS DB instances to help meet SOC 2 compliance requirements. Remember to maintain best practices for security and compliance, review permissions regularly, and monitor logs for any unauthorized access attempts.

Is your System Free of Underlying Vulnerabilities?
Find Out Now