> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# RDS Instances Should Not Be Publicly Accessible

### More Info:

RDS database instances provisioned in your AWS account should not be publicly accessible and should instead restrict unauthorized access in order to minimise security risks.

### Risk Level

High

### Address

Security

### Compliance Standards

* APRA CPS 234 (Australia)
* AWS Startup Security Baseline
* AWS Well Architected Framework
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* DPDPA
* Digital Operational Resilience Act (EU)
* FedRAMP
* GDPR
* HIPAA
* HITRUST CSF
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST
* NIST CSF
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* PCI
* Reserve Bank of India (RBI) Cyber Security Framework
* Reserve Bank of India (RBI) Master Direction – Information Technology Framework
* SOC2
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the issue of RDS instances being publicly accessible in AWS, follow these steps using the AWS Management Console:

        1. **Login to AWS Console**: Go to the AWS Management Console ([https://aws.amazon.com/console/](https://aws.amazon.com/console/)) and log in with your credentials.

        2. **Navigate to RDS Service**: Click on the "Services" dropdown menu at the top of the page, select "RDS" under the Database category.

        3. **Select the RDS Instance**: From the list of RDS instances, select the instance that you want to modify to make it not publicly accessible.

        4. **Modify the Security Group**: In the details page of the selected RDS instance, scroll down to the "Security" section and click on the link for the associated Security Group.

        5. **Edit Inbound Rules**: In the Security Group page, click on the "Inbound rules" tab and locate the rule that allows inbound traffic from any IP address (0.0.0.0/0) on the database port (usually 3306 for MySQL, 5432 for PostgreSQL, etc.).

        6. **Remove the Public Access Rule**: Select the rule that allows public access (0.0.0.0/0) and click on the "Actions" dropdown menu. Then, click on "Delete rule".

        7. **Add a Rule for Specific IP**: If you still need to access the RDS instance from specific IP addresses, you can add a new inbound rule that allows traffic only from those IP addresses. Click on the "Add rule" button, select the type of rule (e.g., MySQL/Aurora, PostgreSQL), and specify the IP range or specific IPs that should be allowed to access the RDS instance.

        8. **Review and Apply Changes**: Review the changes you have made to the Security Group and ensure that only necessary IP addresses have access to the RDS instance. Once you are satisfied, click on the "Save rules" button to apply the changes.

        9. **Verify Public Accessibility**: Finally, go back to the RDS instance details page and verify that the instance is no longer publicly accessible by checking the "Publicly Accessible" attribute. It should be set to "No".

        By following these steps, you have successfully remediated the issue of RDS instances being publicly accessible in AWS.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration of having publicly accessible RDS instances in AWS using AWS CLI, follow these steps:

        1. List all the RDS instances that are publicly accessible:

        ```bash theme={null}
        aws rds describe-db-instances --query "DBInstances[?PubliclyAccessible=='true'].DBInstanceIdentifier" --output text
        ```

        2. For each publicly accessible RDS instance, modify the instance to make it not publicly accessible:

        ```bash theme={null}
        aws rds modify-db-instance --db-instance-identifier YOUR_DB_INSTANCE_IDENTIFIER --no-publicly-accessible
        ```

        Replace `YOUR_DB_INSTANCE_IDENTIFIER` with the actual identifier of the RDS instance.

        3. Verify that the RDS instance is no longer publicly accessible:

        ```bash theme={null}
        aws rds describe-db-instances --db-instance-identifier YOUR_DB_INSTANCE_IDENTIFIER --query "DBInstances[0].PubliclyAccessible"
        ```

        Replace `YOUR_DB_INSTANCE_IDENTIFIER` with the actual identifier of the RDS instance.

        By following these steps, you can remediate the misconfiguration of having publicly accessible RDS instances in AWS using the AWS CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration of having publicly accessible RDS instances in AWS using Python, you can follow these steps:

        1. Install the `boto3` library if you haven't already. You can install it using pip:
           ```
           pip install boto3
           ```

        2. Use the following Python script to update the RDS instance to make it not publicly accessible. Replace `YOUR_RDS_INSTANCE_IDENTIFIER` with the identifier of your RDS instance:

        ```python theme={null}
        import boto3

        # Initialize the RDS client
        client = boto3.client('rds')

        # Update the RDS instance to make it not publicly accessible
        response = client.modify_db_instance(
            DBInstanceIdentifier='YOUR_RDS_INSTANCE_IDENTIFIER',
            PubliclyAccessible=False
        )

        print("RDS instance updated successfully. It is no longer publicly accessible.")
        ```

        3. Run the Python script to update the RDS instance and make it not publicly accessible.

        After running this script, your RDS instance will no longer be publicly accessible, thus remediating the misconfiguration.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "aws_db_instance" "THIS_DB_INSTANCE" {
          # Replace with your existing configuration
          identifier = "DB_INSTANCE_IDENTIFIER" # substitute with the actual DB instance identifier

          # ...other required arguments like engine, instance_class, etc...

          # Remediation: disable public accessibility
          publicly_accessible = false

          # Optional: match CLI behavior (change during next maintenance window)
          # apply_immediately = false
        }
        ```

        This change updates the existing RDS instance in place (no replacement), but AWS may cause a brief outage while modifying the instance, especially if you set `apply_immediately = true`.

        After updating your Terraform, `terraform plan` should show a single in-place update on the `aws_db_instance` resource changing `publicly_accessible` from `true` to `false`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.html](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.html)