RDS Database Instances Should Not Use Default Ports
More Info:
Port obfuscation is as an additional layer of defense against non-targeted attacks. In order to leverage this, your Amazon RDS databases instances should not use their default ports (MySQL/Aurora port 3306, SQL Server port 1433, PostgreSQL port 5432)Risk Level
LowAddress
SecurityCompliance Standards
PCIDSSTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration of RDS Database Instances using default ports in AWS, follow these step-by-step instructions using the AWS Management Console:
- Sign in to the AWS Management Console: Go to https://aws.amazon.com/ and sign in to the AWS Management Console.
- Navigate to RDS Service: Click on the “Services” dropdown menu at the top left corner of the console, then select “RDS” under the Database category.
- Select the RDS Instance: From the list of RDS instances, select the instance that is currently using default ports.
- Modify the RDS Instance: Click on the instance name to open the details page. Then, click on the “Modify” button at the top of the page.
- Update the Port Configuration: In the “Network & Security” section, locate the “Public accessibility” setting. If the RDS instance is publicly accessible, you will see an option to specify the “Publicly accessible” setting and the “Port” number.
- Change the Port Number: Update the “Port” number to a non-default port number of your choice. Ensure that the new port number is not commonly used or reserved for other services.
- Save the Changes: Scroll down to the bottom of the page and click on the “Continue” button. Review the summary of changes, and then click on the “Modify DB Instance” button to apply the changes.
- Verify the Configuration: Once the modification is complete, verify that the RDS instance is now using the updated port number. You can also test the connectivity to the RDS instance using the new port number to ensure that it is working correctly.
Using CLI
Using CLI
To remediate the misconfiguration of RDS database instances using default ports in AWS, you can follow these steps using AWS CLI:
-
Identify the RDS instances that are using default ports:
Run the following AWS CLI command to list all your RDS instances and their associated configurations:
Look for instances that are using default ports (3306 for MySQL, 5432 for PostgreSQL, 1433 for SQL Server, etc.).
-
Modify the RDS instance to use a non-default port:
Run the following AWS CLI command to modify the RDS instance to use a non-default port (replace
your-db-instance-identifierandnew-port-numberwith your actual values): -
Update the security group settings:
If you have security groups attached to your RDS instance, you will need to update the inbound rules to allow traffic on the new port. Run the following AWS CLI command to update the inbound rules of the security group (replace
your-security-group-idandnew-port-numberwith your actual values): -
Verify the changes:
Run the following AWS CLI command to describe the modified RDS instance and ensure that the port has been updated successfully:
Using Python
Using Python
To remediate the misconfiguration of RDS Database Instances using default ports in AWS, you can use the AWS SDK for Python (Boto3) to modify the security group associated with the RDS instance to restrict access to a specific port. Here are the step-by-step instructions to remediate this issue:
- Install the Boto3 library:
-
Configure your AWS credentials by either setting environment variables or using the AWS CLI
aws configurecommand. - Use the following Python script to modify the security group associated with the RDS instance to restrict access to a specific port (e.g., 3306):
-
Replace
YOUR_DB_INSTANCE_IDENTIFIERwith the identifier of your RDS instance. - Run the Python script. It will modify the security group associated with the RDS instance to allow inbound traffic only on the specified port (3306 in this case).