RDS instance must not be publicly accessible

Applies to

• AWS::RDS::DBInstance

What CGPulse checks

A resource passes this rule when publiclyAccessible must equal false. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Disable public accessibility and access the database only through the VPC or VPN. In AWS Console: RDS > Databases > Modify > set Publicly accessible to No. See: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_VPC.WorkingWithRDSInstanceinaVPC.html

CLI

aws rds modify-db-instance --db-instance-identifier "{id}" --no-publicly-accessible

Terraform

resource "aws_db_instance" "{name}" {
  publicly_accessible = false
}

Compliance frameworks

• Cloud Foundations Benchmark v3.02.3.3
• Cloud Security: AWS Foundations
• GDPR: Data Protection Controls
• ISO 27001: Information SecurityA.13.1.1
• NIST 800-53: Cloud Security ControlsSC-7
• PCI DSS v4.01.3.2
• SOC 2: Trust ServicesCC6.6

Related AWS rules

• ACM certificate must be eligible for renewal
• ACM certificate must be in issued status
• Amplify app should have basic auth disabled for production
• API Gateway REST API must have an endpoint configuration
• API Gateway V2 API must be properly configured
• App Runner service must have encryption enabled
• AppSync API must have logging configured
• AppSync API must have X-Ray tracing enabled