cis-aws-database-2-10

name	cis-aws-database-2.10
description	Ensure Database has IAM Auth is Enabled
category	cis-database
version	2.0.0
author	cyberstrike-official
tags	["cis","aws","database","aurora","iam-auth","authentication","identity","access-control"]
cis_id	2.10
cis_benchmark	CIS AWS Database Services Benchmark v2.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-database-2.4","cis-aws-database-2.7"]
prerequisites	[]
severity_boost	{}

2.10 Ensure Database has IAM Auth is Enabled (Manual)

Description

AuroraDB clusters should be configured to leverage AWS IAM authentication for database connections. This ensures that users authenticate using temporary IAM-based tokens rather than static long-lived passwords.

Rationale

Enabling IAM authentication for AuroraDB centralizes and strengthens access control by integrating database authentication with broader AWS IAM identity management. This approach eliminates the risks associated with hard-coded credentials, reduces administrative overhead for password rotation, and allows precise access management using IAM identities and policies.

Impact

With the usage of IAM database authentication instead of static passwords, AuroraDB clusters are protected against credential leakage and weak password practices, making unauthorized access significantly more difficult. This reduces the attack surface, supports audit and compliance, and ensures that database access is tightly aligned with enterprise identity governance and cloud security standards.

Audit Procedure

Using AWS CLI

1. List AuroraDB clusters and check IAM authentication status:

aws rds describe-db-clusters \
  --query "DBClusters[*].{DBClusterIdentifier:DBClusterIdentifier,IAMDatabaseAuthenticationEnabled:IAMDatabaseAuthenticationEnabled}" \
  --output table

2. List database users enabled for IAM authentication (Aurora MySQL):

• For MySQL, connect to the cluster and run below command to ensure that required database users exist for IAM token logins.

SELECT user, plugin FROM mysql.user WHERE plugin='AWSAuthenticationPlugin';

• For Postgres, connect to the cluster and run below command to verify that necessary users are granted the rds_iam role.

SELECT r.rolname
FROM pg_roles AS r
JOIN pg_auth_members AS m ON r.oid = m.member
JOIN pg_roles AS g ON m.roleid = g.oid
 g.rolname  ;