-
AWS RDS
Monitor and audit RDS instances to ensure security, availability, reliability is not compromised.
Security
Public Snapshots
Ensure that your AWS Relational Database Service (RDS) database snapshots are not publicly accessible. This is to avoid exposing your private data.
Ensure that your AWS Relational Database Service (RDS) database snapshots are not publicly accessible. This is to avoid exposing your private data.
Serverless Log Exports Enabled
Aurora Serverless databases offer Log Exports feature. Enable it in order to publish general logs, slow query logs, audit logs and error logs to AWS CloudWatch.
Aurora Serverless databases offer Log Exports feature. Enable it in order to publish general logs, slow query logs, audit logs and error logs to AWS CloudWatch.
Instance Deletion Protection
Amazon RDS provides a Deletion Protection Flag which should be enabled to prevent accidental prevention of the database.
Amazon RDS provides a Deletion Protection Flag which should be enabled to prevent accidental prevention of the database.
Encryption Enabled
RDS database instances should be encrypted to fulfill compliance requirements for data-at-rest encryption.
RDS database instances should be encrypted to fulfill compliance requirements for data-at-rest encryption.
Master Username
It is not a good practice to use awsuser or admin as master username for your database connection. Instead, use unique alphanumeric username.
It is not a good practice to use awsuser or admin as master username for your database connection. Instead, use unique alphanumeric username.
Publicly Accessible
Any public facing RDS database instances provisioned in your AWS account and restrict unauthorized access in order to minimise security risks.
Any public facing RDS database instances provisioned in your AWS account and restrict unauthorized access in order to minimise security risks.
Unrestricted In/Outbound Access
If your RDS instance and it's security group allows access to everyone by setting 0.0.0.0/0, then it invites malicious users to target your database and make your security posture more vulnerable.
If your RDS instance and it's security group allows access to everyone by setting 0.0.0.0/0, then it invites malicious users to target your database and make your security posture more vulnerable.
Transport Encryption feature must be enabled
Ensure that Microsoft SQL Server and PostgreSQL instances provisioned with Amazon RDS have Transport Encryption feature enabled in order to meet security and compliance requirements
Ensure that Microsoft SQL Server and PostgreSQL instances provisioned with Amazon RDS have Transport Encryption feature enabled in order to meet security and compliance requirements
Snapshot Encryption feature must be enabled
Ensure that your Amazon Relational Database Service (RDS) snapshots are encrypted in order to achieve compliance for data-at-rest encryption within your organization
Ensure that your Amazon Relational Database Service (RDS) snapshots are encrypted in order to achieve compliance for data-at-rest encryption within your organization
Ensure IAM DB authentication is enabled
Ensure IAM Database Authentication feature is enabled in order to use AWS Identity and Access Management (IAM) service to manage database access to your Amazon RDS MySQL and PostgreSQL instances
Ensure IAM Database Authentication feature is enabled in order to use AWS Identity and Access Management (IAM) service to manage database access to your Amazon RDS MySQL and PostgreSQL instances
Enable Auto Minor Version Upgrade flag
Ensure that your RDS database instances have the Auto Minor Version Upgrade flag enabled in order to receive automatically minor engine upgrades during the specified maintenance window
Ensure that your RDS database instances have the Auto Minor Version Upgrade flag enabled in order to receive automatically minor engine upgrades during the specified maintenance window
Use customer-managed keys instead of AWS-managed keys
Ensure that your RDS database instances are using KMS CMK customer-managed keys rather than AWS managed-keys in order to have more granular control over your data-at-rest encryption/decryption process.
Ensure that your RDS database instances are using KMS CMK customer-managed keys rather than AWS managed-keys in order to have more granular control over your data-at-rest encryption/decryption process.
RDS DB Instances must not be provisioned in VPC Public Subnets
Ensure that no AWS RDS database instances are provisioned inside VPC public subnets in order to protect them from direct exposure to the Internet
Ensure that no AWS RDS database instances are provisioned inside VPC public subnets in order to protect them from direct exposure to the Internet
Operational Maturity
Reliability
Automated Backups Enabled
Enable automated backups of your RDS database instances to ensure point-in-time recovery.
Enable automated backups of your RDS database instances to ensure point-in-time recovery.
Desired Instance Type
It is recommended that RDS database instances use instance types from a limited set based on the database workload deployed.
It is recommended that RDS database instances use instance types from a limited set based on the database workload deployed.
Free Storage Space
If your RDS databases are running low on disk space, they introduce a high risk of hurting your performance and availability.
If your RDS databases are running low on disk space, they introduce a high risk of hurting your performance and availability.
Backup Retention Duration
As an organization you should have a backup policy with atleast minimum 7 days.
As an organization you should have a backup policy with atleast minimum 7 days.
Public/Private well defined in Aurora Clusters
Ensure that all the database instances within your Amazon Aurora clusters have the same accessibility (either public or private) in order to follow AWS best practices.
Ensure that all the database instances within your Amazon Aurora clusters have the same accessibility (either public or private) in order to follow AWS best practices.
Backtrack must be enabled
Ensure that Backtrack feature is enabled for your Amazon Aurora with MySQL compatibility database clusters in order to backtrack your clusters to a specific time, without using backups
Ensure that Backtrack feature is enabled for your Amazon Aurora with MySQL compatibility database clusters in order to backtrack your clusters to a specific time, without using backups
Event Notification Subscriptions must be enabled
Ensure that Amazon RDS event notification subscriptions are enabled for database instance level events
Ensure that Amazon RDS event notification subscriptions are enabled for database instance level events
Performance Insights feature must be enabled
Ensure that your AWS RDS MySQL and PostgreSQL database instances have Performance Insights feature enabled in order to allow you to obtain a better overview of your databases performance
Ensure that your AWS RDS MySQL and PostgreSQL database instances have Performance Insights feature enabled in order to allow you to obtain a better overview of your databases performance
Event Notifications must be enabled
Ensure that your AWS RDS resources have event notifications enabled in order to be notified when an event occurs for a given database instance, database snapshot, database security group or database parameter group
Ensure that your AWS RDS resources have event notifications enabled in order to be notified when an event occurs for a given database instance, database snapshot, database security group or database parameter group
Use Multi-AZ Deployment for RDS
Ensure that your RDS clusters are using Multi-AZ deployment configurations for high availability and automatic failover support fully managed by AWS.
Ensure that your RDS clusters are using Multi-AZ deployment configurations for high availability and automatic failover support fully managed by AWS.
Enable Security Groups Events Subscriptions
Ensure that Amazon RDS event notification subscriptions are enabled for database security groups events. AWS RDS groups these events into categories that you can subscribe to.
Ensure that Amazon RDS event notification subscriptions are enabled for database security groups events. AWS RDS groups these events into categories that you can subscribe to.
Performance Efficiency
All DB instances must use latest generation of instance classes
Ensure that all RDS databases instances provisioned within your AWS account are using the latest generation of instance classes in order to get the best performance with lower costs.
Ensure that all RDS databases instances provisioned within your AWS account are using the latest generation of instance classes in order to get the best performance with lower costs.
Cost Optimisation
Identify Idle RDS instances
Identify any Amazon RDS database instances that appear to be idle and delete them to help lower the cost of your monthly AWS bill
Identify any Amazon RDS database instances that appear to be idle and delete them to help lower the cost of your monthly AWS bill
Use Copy Tags to Snapshots feature
Ensure that RDS instances make use of Copy Tags to Snapshots feature in order to allow tags set on database instances to be automatically copied to any automated or manual RDS snapshots that are created from these instances
Ensure that RDS instances make use of Copy Tags to Snapshots feature in order to allow tags set on database instances to be automatically copied to any automated or manual RDS snapshots that are created from these instances
Use General Purpose SSDs instead of IOPS SSDs
Ensure that your RDS instances are using General Purpose SSDs instead of Provisioned IOPS SSDs for cost-effective storage that fits a broad range of database workloads
Ensure that your RDS instances are using General Purpose SSDs instead of Provisioned IOPS SSDs for cost-effective storage that fits a broad range of database workloads
Renew RDS Reserved Instances before expiration (30 days)
Ensure that your AWS RDS Reserved Instances (RIs) are renewed before expiration in order to get the appropriate discount on the hourly charge for these instances
Ensure that your AWS RDS Reserved Instances (RIs) are renewed before expiration in order to get the appropriate discount on the hourly charge for these instances
Renew RDS Reserved Instances before expiration (7 days)
Ensure that your AWS RDS Reserved Instances (RIs) are renewed before expiration in order to get the appropriate discount on the hourly charge for these instances
Ensure that your AWS RDS Reserved Instances (RIs) are renewed before expiration in order to get the appropriate discount on the hourly charge for these instances
Identify failed RDS RI Instances
Identify any failed RDS Reserved Instances (RIs) available within your AWS account. A failed RDS RI is an unsuccessful reservation that received the "payment-failed" status during the purchase process.
Identify any failed RDS Reserved Instances (RIs) available within your AWS account. A failed RDS RI is an unsuccessful reservation that received the "payment-failed" status during the purchase process.
Identify Pending RDS RI Purchases
Identify any pending RDS Reserved Instance (RI) purchases available within your AWS account. A payment-pending RDS RI purchase is a reservation purchase that cannot be fully processed due to issues with the payment method
Identify any pending RDS Reserved Instance (RI) purchases available within your AWS account. A payment-pending RDS RI purchase is a reservation purchase that cannot be fully processed due to issues with the payment method
Review purchases every 7 days
Ensure that all Amazon RDS Reserved Instance (RI) purchases are reviewed every 7 days in order to confirm that no unwanted reservation purchase has been placed recently.
Ensure that all Amazon RDS Reserved Instance (RI) purchases are reviewed every 7 days in order to confirm that no unwanted reservation purchase has been placed recently.
Identify RDS Instances which are underutilized
dentify any Amazon RDS database instances that appear to be underutilized and downsize (resize) them to help lower the cost of your monthly AWS bill
dentify any Amazon RDS database instances that appear to be underutilized and downsize (resize) them to help lower the cost of your monthly AWS bill
Ensure RDS RIs have corresponding DB Instances
Ensure that all your AWS RDS Reserved Instances (RI) have corresponding database instances running within the same account or within any AWS accounts members of an AWS Organization
Ensure that all your AWS RDS Reserved Instances (RI) have corresponding database instances running within the same account or within any AWS accounts members of an AWS Organization
Sources
Help Us Improve!
If you have any suggestions to improve this checklist, please let us know by filling out this form.