Master Username Should Be Unique

More Info:

It is not a good practice to use awsuser or admin as master username for your database connection. Instead, use unique alphanumeric username.

Risk Level

Low

Address

Security

Compliance Standards

APRA CPS 234 (Australia)
BSI C5 (Germany)
Brazil LGPD
CCPA / CPRA (California)
CIS Critical Security Controls v8
CMMC 2.0
CSA Cloud Controls Matrix v4
DPDPA
Digital Operational Resilience Act (EU)
Essential 8
ISO/IEC 27017
ISO/IEC 27018
ISO/IEC 27701
KSA PDPL
MAS Technology Risk Management (Singapore)
MITRE ATT&CK (Cloud)
NIS2 Directive
NIST SP 800-171
NYDFS 23 NYCRR 500
PCI
SWIFT Customer Security Controls Framework
Sarbanes-Oxley IT General Controls
UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the issue of the master username not being unique for an AWS RDS instance, you can follow these steps using the AWS Management Console:

Sign in to the AWS Management Console: Go to the AWS Management Console (https://aws.amazon.com/console/) and sign in using your credentials.
Navigate to RDS Service: Click on the "Services" dropdown menu at the top of the page and select "RDS" under the Database section.
Select the RDS Instance: From the list of RDS instances, select the instance for which you want to change the master username.
Modify the Master Username: In the RDS dashboard, locate the "Configuration" section and click on the "Modify" button.
Change the Master Username: In the Modify DB Instance window, scroll down to the "Master Username" field and enter a unique username that you want to set as the new master username.
Apply the Changes: Scroll down to the bottom of the page and click on the "Continue" button.
Review and Apply Changes: Review the changes you are about to make and click on the "Modify DB Instance" button to apply the changes.
Monitor the Modification: The modification process may take a few minutes to complete. You can monitor the progress in the RDS console.
Verify the Changes: Once the modification is complete, verify that the master username has been successfully changed to a unique username.

By following these steps, you can remediate the issue of the master username not being unique for an AWS RDS instance using the AWS Management Console.

Using CLI

To remediate the issue of the master username not being unique for an AWS RDS instance using the AWS CLI, follow these steps:

Identify the RDS Instance: First, identify the RDS instance for which you need to change the master username. You can list all your RDS instances using the following AWS CLI command:
```
aws rds describe-db-instances
```
Modify the Master Username: Once you have identified the RDS instance, you can modify the master username using the modify-db-instance command. Replace your-db-instance-identifier with the actual DB instance identifier and new-master-username with the unique username you want to set:
```
aws rds modify-db-instance --db-instance-identifier your-db-instance-identifier --master-user-password your-new-master-username
```
Wait for the Modification to Complete: The modification process may take some time to complete. You can check the status of the modification using the describe-db-instances command:
```
aws rds describe-db-instances --db-instance-identifier your-db-instance-identifier --query "DBInstances[*].DBInstanceStatus"
```
Verify the Changes: Once the modification is complete, verify that the master username has been successfully updated by describing the DB instance:
```
aws rds describe-db-instances --db-instance-identifier your-db-instance-identifier --query "DBInstances[*].MasterUsername"
```

By following these steps, you can successfully remediate the issue of a non-unique master username for an AWS RDS instance using the AWS CLI.

Using Python

To remediate the issue of non-unique master username for an AWS RDS instance using Python, you can follow these steps:

Use the AWS SDK for Python (Boto3) to interact with AWS services programmatically. Make sure you have the Boto3 library installed in your Python environment.

Write a Python script that does the following:

a. Import the necessary libraries:

import boto3

b. Initialize the RDS client:

rds_client = boto3.client('rds', region_name='your_region')

c. List all existing RDS instances:

response = rds_client.describe_db_instances()

d. Check if the master username is unique:

master_username = 'your_desired_master_username'
existing_usernames = [instance['MasterUsername'] for instance in response['DBInstances']]

if master_username in existing_usernames:
    print(f"Master username '{master_username}' is already in use. Please choose a different username.")
    # You can either prompt the user to enter a new unique username or generate a unique username programmatically
else:
    print(f"Master username '{master_username}' is unique.")

Run the Python script to check if the master username is unique. If it's not unique, prompt the user to enter a new unique username or generate a unique username programmatically.

If the user enters a new unique username, update the master username for the RDS instance using the modify_db_instance method:

rds_client.modify_db_instance(
    DBInstanceIdentifier='your_db_instance_id',
    MasterUsername='your_new_master_username',
    ApplyImmediately=True
)

Verify that the master username has been successfully updated by describing the RDS instance again and checking the master username.

By following these steps, you can remediate the issue of a non-unique master username for an AWS RDS instance using Python.

Using Terraform

# Existing DB instance (already in your configuration)
resource "aws_db_instance" "existing" {
  identifier = "EXISTING_DB_INSTANCE_IDENTIFIER" # replace with your current DB instance identifier

  # ... all your existing settings (engine, instance_class, subnet_group, etc.) ...

  # Ensure you are NOT hard-coding a weak/standard master username like "admin" or "awsuser"
  # This resource represents the current state and will eventually be removed.
}

# 1) Create a snapshot of the current DB instance (backup before change)
resource "aws_db_snapshot" "username_change" {
  db_instance_identifier = aws_db_instance.existing.id
  db_snapshot_identifier = "${aws_db_instance.existing.identifier}-username-change-snapshot"
}

# 2) Restore a NEW DB instance from the snapshot with a NEW master username and password
resource "aws_db_instance" "replacement" {
  identifier          = "${aws_db_instance.existing.identifier}-new"
  snapshot_identifier = aws_db_snapshot.username_change.id

  # New secure, unique master username and password
  username = "NEW_UNIQUE_ALPHANUMERIC_MASTER_USERNAME"  # replace with your new unique username
  password = "NEW_STRONG_MASTER_PASSWORD"               # replace with a strong password

  # Copy critical settings from the existing instance so behavior matches
  instance_class          = aws_db_instance.existing.instance_class
  db_subnet_group_name    = aws_db_instance.existing.db_subnet_group_name
  vpc_security_group_ids  = aws_db_instance.existing.vpc_security_group_ids
  publicly_accessible     = aws_db_instance.existing.publicly_accessible
  multi_az                = aws_db_instance.existing.multi_az
  storage_type            = aws_db_instance.existing.storage_type
  allocated_storage       = aws_db_instance.existing.allocated_storage
  engine                  = aws_db_instance.existing.engine
  engine_version          = aws_db_instance.existing.engine_version
  parameter_group_name    = aws_db_instance.existing.parameter_group_name
  option_group_name       = aws_db_instance.existing.option_group_name
  backup_retention_period = aws_db_instance.existing.backup_retention_period

  # Ensure deletion protection and maintenance options are set as desired
  deletion_protection = false

  depends_on = [aws_db_snapshot.username_change]
}

# 3) After thoroughly testing aws_db_instance.replacement and updating ALL applications
#    to use its NEW endpoint, delete the original instance.
#    This is IRREVERSIBLE, though a final snapshot will be created.
resource "aws_db_instance" "existing_to_delete" {
  identifier = aws_db_instance.existing.identifier

  # Use the same arguments as aws_db_instance.existing (or move that block here),
  # but configure it to be deleted with a final snapshot.
  # Terraform will destroy this resource on apply.

  # ... copy all the same settings as in aws_db_instance.existing ...

  deletion_protection       = false
  skip_final_snapshot       = false
  final_snapshot_identifier = "${aws_db_instance.existing.identifier}-final-snapshot"

  lifecycle {
    prevent_destroy = false
  }
}

This change is a replacement: it creates a new DB instance from a snapshot with a new master username, then destroys the old instance after cutover. It will produce a new endpoint URL, you MUST update application connection strings, and the process can cause downtime; plan a maintenance window or blue/green strategy. Deleting the original instance is irreversible, though a final snapshot is created.

To verify, terraform plan should show:

aws_db_snapshot.username_change: + create
aws_db_instance.replacement: + create (new instance with the new master username)
Once you keep only aws_db_instance.replacement and the deletion-configured block for the old instance, the plan should show the old aws_db_instance scheduled for - destroy with a final snapshot.

Additional Reading:

https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_BestPractices.html

More Info:​

Risk Level​

Address​

Compliance Standards​

Triage and Remediation​

Remediation​

Additional Reading:​