cis-aws-foundations-3-2-3

name	cis-aws-foundations-3.2.3
description	Ensure that RDS instances are not publicly accessible
category	cis-storage
version	7.0.0
author	cyberstrike-official
tags	["cis","aws","storage","rds","public-access","network-security","vpc"]
cis_id	3.2.3
cis_benchmark	CIS AWS Foundations Benchmark v7.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-foundations-3.2.1","cis-aws-foundations-3.2.2","cis-aws-foundations-3.2.4"]
prerequisites	[]
severity_boost	{}

Ensure that RDS instances are not publicly accessible

Description

Ensure and verify that the RDS database instances provisioned in your AWS account restrict unauthorized access in order to minimize security risks. To restrict access to any RDS database instance, you must disable the Publicly Accessible flag for the database and update the VPC security group associated with the instance.

Rationale

Ensure that no public-facing RDS database instances are provisioned in your AWS account, and restrict unauthorized access in order to minimize security risks. When the RDS instance allows unrestricted access (0.0.0.0/0), anyone and anything on the Internet can establish a connection to your database, which can increase the opportunity for malicious activities such as brute force attacks, PostgreSQL injections, or DoS/DDoS attacks.

Impact

Disabling public accessibility may require application reconfiguration to use private endpoints or VPN connections. Ensure all applications connecting to the RDS instance can reach it through private networking before making changes.

Audit Procedure

Using AWS Console

1. Log in to the AWS management console and navigate to the RDS dashboard at https://console.aws.amazon.com/rds/.
2. Under the navigation panel, on the RDS dashboard, click Databases.
3. Select the RDS instance that you want to examine.
4. Click Instance Name from the dashboard, under Connectivity and Security.
5. In the Security section, check if the Publicly Accessible flag status is set to No.
6. Follow the steps below to check database subnet access:
   • In the networking section, click the subnet link under Subnets.
   • The link will redirect you to the VPC Subnets page.
   • Select the subnet listed on the page and click the Route Table tab from the dashboard bottom panel.
   • If the route table contains any entries with the destination CIDR block set to 0.0.0.0/0 and an Internet Gateway attached, the selected RDS database instance was provisioned inside a public subnet; therefore, it is not running within a logically isolated environment and can be accessed from the Internet.
7. Repeat steps 3-6 to determine the configuration of other RDS database instances provisioned in the current region.
8. Change the AWS region from the navigation bar and repeat the audit process for other regions.

Using AWS CLI