Skip to main content

RDS Instance Count Should Not Exceed Limit

More Info:​

AWS account has Limit Quotas on every service including RDS. The number of RDS database instances provisioned in your AWS account should not have reached the limit quota.

Risk Level​

Medium

Address​

Operational Maturity, Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • AWS Well Architected Framework
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To remediate the issue of RDS Instance Count exceeding the limit in AWS, you can follow these steps using the AWS Management Console:

  1. Identify the RDS Instances:

    • Login to your AWS Management Console.
    • Navigate to the RDS service.
    • Click on "Databases" from the left-hand menu to view all your RDS instances.

  2. Identify the Limit:

    • Check the current limit for the maximum number of RDS instances allowed in your account.
    • You can find this information in the RDS service limits documentation or by contacting AWS support.

  3. Consolidate or Delete Unnecessary Instances:

    • Identify any unnecessary or unused RDS instances that can be consolidated or deleted to stay within the limit.
    • Select the RDS instances that are no longer required.
    • Click on the "Actions" dropdown menu and choose "Delete" to remove the selected instances.

  4. Modify Existing Instances:

    • If deleting instances is not an option, consider modifying existing instances to meet your requirements.
    • For example, you can modify instance type, storage capacity, or enable/disable Multi-AZ deployment based on your needs.

  5. Request a Limit Increase:

    • If you need to exceed the current limit due to valid reasons, you can request a limit increase from AWS support.
    • Go to the AWS Support Center and submit a limit increase request for RDS instances, providing the necessary details and justification.

  6. Monitor and Maintain:

    • Regularly monitor your RDS instances to ensure that you stay within the limit and optimize resource usage.
    • Implement tagging strategies to better manage and track your RDS instances.

By following these steps, you can remediate the issue of RDS Instance Count exceeding the limit in AWS and ensure compliance with your account limits.

Using CLI

To remediate the issue of RDS instance count exceeding the limit in AWS using AWS CLI, follow these steps:

  1. Identify the current RDS instance count: You can use the following AWS CLI command to list all RDS instances in your account:

    aws rds describe-db-instances

  2. Check the RDS instance limit: Determine the maximum number of RDS instances allowed in your account by using the following AWS CLI command:

    aws rds describe-account-attributes

  3. Delete unnecessary RDS instances: Identify any unnecessary RDS instances that can be deleted to bring the count below the limit. Use the following AWS CLI command to delete an RDS instance:

    aws rds delete-db-instance --db-instance-identifier <instance-identifier> --skip-final-snapshot

  4. Modify existing RDS instances: If deleting instances is not an option, consider modifying existing RDS instances to reduce the count. For example, you can modify an RDS instance to a smaller instance type or combine multiple databases into a single instance.

  5. Request a limit increase: If you require more RDS instances than the current limit allows, you can request a limit increase from AWS. Use the following AWS CLI command to request a limit increase for RDS instances:

    aws rds modify-account-attributes --account-quotas Name=db-instance --max=<new-limit>

  6. Monitor and maintain: Regularly monitor your RDS instances to ensure that the count stays within the allowed limit. Remove any unnecessary instances and adjust configurations as needed.

By following these steps, you can remediate the issue of RDS instance count exceeding the limit in AWS using AWS CLI.

Using Python

To remediate the issue of RDS instance count exceeding the limit in AWS using Python, you can create a script that regularly checks the number of RDS instances and takes appropriate actions to ensure it does not exceed the limit. Here's a step-by-step guide to remediate this issue:

  1. Install Boto3: Boto3 is the AWS SDK for Python. You can install it using pip by running the following command:

    pip install boto3

  2. Create a Python Script: Create a Python script (e.g., remediate_rds_instance_limit.py) with the following code:

    import boto3

    # AWS credentials and region
    aws_access_key = 'YOUR_AWS_ACCESS_KEY'
    aws_secret_key = 'YOUR_AWS_SECRET_KEY'
    aws_region = 'YOUR_AWS_REGION'

    # Initialize the RDS client
    rds_client = boto3.client('rds', aws_access_key_id=aws_access_key, aws_secret_access_key=aws_secret_key, region_name=aws_region)

    def get_rds_instance_count():
        response = rds_client.describe_db_instances()
        return len(response['DBInstances'])

    def create_rds_instance():
        # You can add your logic here to create a new RDS instance

    # Check the RDS instance count
    current_instance_count = get_rds_instance_count()

    if current_instance_count > YOUR_INSTANCE_LIMIT:
        # Take remediation action (e.g., delete an existing instance or create a new instance)
        create_rds_instance()

  3. Set up AWS Credentials: Ensure that you have AWS access key and secret key with the necessary permissions to manage RDS instances. You can set up these credentials using AWS CLI or environment variables.

  4. Set Your Instance Limit: Replace YOUR_INSTANCE_LIMIT with the maximum number of RDS instances allowed in your AWS account.

  5. Implement Remediation Logic: In the create_rds_instance() function, you can add the logic to either delete an existing RDS instance or create a new one based on your remediation strategy.

  6. Schedule the Script: You can schedule the script to run at regular intervals using tools like AWS CloudWatch Events, AWS Lambda, or cron job on a server.

By following these steps, you can automatically remediate the issue of RDS instance count exceeding the limit in AWS using Python.

Using Terraform
# Option 1 (recommended when you truly no longer need the DB): delete unneeded RDS instances,
# taking a final snapshot on deletion to match the CLI behavior.

resource "aws_db_instance" "UNNEEDED_DB_INSTANCE" {
  # Substitute:
  # - UNNEEDED_DB_INSTANCE with your Terraform resource name
  # - DB_INSTANCE_IDENTIFIER with the DBInstanceIdentifier from the finding
  # - DB_INSTANCE_CLASS, ENGINE, etc. to match the existing instance

  identifier          = "DB_INSTANCE_IDENTIFIER"
  instance_class      = "DB_INSTANCE_CLASS"
  engine              = "ENGINE"
  allocated_storage   = 20
  username            = "MASTER_USERNAME"
  password            = "MASTER_PASSWORD"
  skip_final_snapshot = false
  # Must be unique; this is equivalent to --final-db-snapshot-identifier {{asset_label}}-final-snapshot
  final_snapshot_identifier = "DB_INSTANCE_IDENTIFIER-final-snapshot"

  # Make sure deletion protection is disabled so Terraform can destroy it
  deletion_protection = false
}

# To actually remediate, remove this aws_db_instance resource from your Terraform configuration
# (or target it with `terraform destroy -target=aws_db_instance.UNNEEDED_DB_INSTANCE`).
# With skip_final_snapshot = false and final_snapshot_identifier set, Terraform will
# create a final snapshot before deleting the instance, matching the CLI remediation.
#
# WARNING: This is a destructive action that will permanently delete the RDS instance
# and its automated backups; ensure any needed data is backed up before applying.
# WARNING: If you set skip_final_snapshot = true you will NOT get a final snapshot.


# Option 2 (alternative when you need more RDS instances): request a quota increase.

resource "aws_servicequotas_service_quota" "rds_db_instances_quota" {
  # Substitute NEW_LIMIT with the desired quota value, greater than the current quota.
  service_code = "rds"
  quota_code   = "L-7241B892" # 'DB instances' quota for standard DB instance classes
  value        = NEW_LIMIT    # e.g., 100
}

# WARNING: Quota increases are subject to AWS approval and are not instantaneous.
# WARNING: Verify that L-7241B892 is the correct quota code for your instance classes;
#           other codes may apply for specialized instance types.

For verification:

  • For Option 1, after removing the aws_db_instance.UNNEEDED_DB_INSTANCE from configuration or running a targeted destroy, terraform plan should show that specific aws_db_instance resource with a - (destroy) action, and no recreate.
  • For Option 2, terraform plan should show + (create) for aws_servicequotas_service_quota.rds_db_instances_quota or ~ (update) if changing value on an existing quota resource.

Additional Reading:​