Skip to main content

Neptune Cluster Has IAM Database Authentication Should Be

More Info:​

This rule checks if an Amazon Neptune cluster has AWS Identity and Access Management (IAM) database authentication enabled. The rule is NON_COMPLIANT if an Amazon Neptune cluster does not have IAM database authentication enabled.

Risk Level​

High

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To remediate the misconfiguration of IAM Database Authentication not being enabled for an AWS RDS Neptune cluster, follow these steps using the AWS Management Console:

  1. Login to AWS Console: Go to the AWS Management Console (https://aws.amazon.com/) and login using your credentials.

  2. Navigate to RDS Service: Click on the "Services" dropdown menu at the top and select "RDS" under the Database category.

  3. Select Neptune Cluster: From the list of RDS database instances, select the Neptune cluster for which you want to enable IAM Database Authentication.

  4. Modify Cluster: In the cluster details page, click on the "Modify" button at the top to make changes to the cluster settings.

  5. Enable IAM Database Authentication: Scroll down to the "Additional configuration" section, find the "IAM Database Authentication" option, and set it to "Enabled".

  6. Apply Changes: Scroll to the bottom of the page and click on the "Continue" button.

  7. Review and Apply Changes: Review the changes you are about to make and click on the "Modify cluster" button to apply the changes.

  8. Wait for Modification to Complete: The modification process may take a few minutes to complete. You can track the progress on the cluster details page.

  9. Verify IAM Database Authentication: Once the modification is complete, go back to the cluster details page and verify that IAM Database Authentication is now enabled for the Neptune cluster.

By following these steps, you have successfully remediated the misconfiguration of IAM Database Authentication not being enabled for your AWS RDS Neptune cluster using the AWS Management Console.

Using CLI

To remediate the misconfiguration of IAM Database Authentication not being enabled for an AWS RDS Neptune Cluster using AWS CLI, follow these steps:

  1. Check the Current Status: Run the following AWS CLI command to check the current status of IAM Database Authentication for the Neptune Cluster:

    aws neptune describe-db-clusters --db-cluster-identifier YOUR_DB_CLUSTER_IDENTIFIER

  2. Enable IAM Database Authentication: If IAM Database Authentication is not enabled, you can enable it using the following AWS CLI command:

    aws neptune modify-db-cluster --db-cluster-identifier YOUR_DB_CLUSTER_IDENTIFIER --enable-iam-database-authentication

  3. Verify the Changes: Run the describe-db-clusters command again to verify that IAM Database Authentication has been successfully enabled:

    aws neptune describe-db-clusters --db-cluster-identifier YOUR_DB_CLUSTER_IDENTIFIER

  4. Test the Configuration: Test the IAM Database Authentication by connecting to the Neptune Cluster using IAM credentials. Make sure to have the necessary IAM permissions and generate an IAM token to authenticate.

  5. Update Security Groups (Optional): If needed, update the security groups associated with the Neptune Cluster to allow inbound traffic on the port where the database is listening for IAM authenticated connections.

By following these steps, you can remediate the misconfiguration of IAM Database Authentication not being enabled for an AWS RDS Neptune Cluster using AWS CLI.

Using Python

To remediate the misconfiguration of IAM Database Authentication not being enabled for an AWS RDS Neptune Cluster using Python, you can follow these steps:

  1. Install the necessary Python libraries:
pip install boto3
  1. Use the following Python script to enable IAM Database Authentication for the Neptune Cluster:
import boto3

# Specify the region where your Neptune Cluster is located
region = 'your_region'

# Specify the name of your Neptune Cluster
cluster_identifier = 'your_neptune_cluster_identifier'

# Create a Neptune client
client = boto3.client('neptune', region_name=region)

# Enable IAM Database Authentication for the Neptune Cluster
response = client.modify_db_cluster(
    DBClusterIdentifier=cluster_identifier,
    EnableIAMDatabaseAuthentication=True
)

# Print the response
print(response)

  1. Replace 'your_region' with the actual region where your Neptune Cluster is located and 'your_neptune_cluster_identifier' with the actual identifier of your Neptune Cluster.

  2. Run the Python script, and IAM Database Authentication will be enabled for your Neptune Cluster.

By following these steps, you can remediate the misconfiguration of IAM Database Authentication not being enabled for an AWS RDS Neptune Cluster using Python.

Using Terraform
resource "aws_neptune_cluster" "THIS_CLUSTER" {
  cluster_identifier                  = "NEPTUNE_CLUSTER_IDENTIFIER" # replace with your cluster identifier
  engine                              = "neptune"
  master_username                     = "MASTER_USERNAME"            # replace with your master username
  master_password                     = "MASTER_PASSWORD"            # replace with your master password (or use sensitive input)
  iam_database_authentication_enabled = true
  # ...any other arguments you already use (vpc_security_group_ids, subnet_group_name, etc.)
}

Enabling iam_database_authentication_enabled = true is effectively irreversible on the cluster (you cannot later disable it); however, it does not force Terraform to replace the cluster, it will be applied in-place.

After adding this to your configuration (or updating the existing aws_neptune_cluster), terraform plan should show an in-place update on the Neptune cluster with iam_database_authentication_enabled changing from false (or 0) to true (or 1).

Additional Reading:​