cis-aws-database-2-6

name	cis-aws-database-2.6
description	Ensure Passwords are Regularly Rotated
category	cis-database
version	2.0.0
author	cyberstrike-official
tags	["cis","aws","database","aurora","passwords","rotation","credentials","access-management"]
cis_id	2.6
cis_benchmark	CIS AWS Database Services Benchmark v2.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-database-2.4","cis-aws-database-2.7"]
prerequisites	[]
severity_boost	{}

2.6 Ensure Passwords are Regularly Rotated (Manual)

Description

Regularly rotating your Aurora passwords is critical to access management, contributing to maintaining system security. The database password can be rotated in Amazon Aurora, but the access keys refer to the rotation of AWS IAM User access keys.

Rationale

Updating your password is critical to access AWS resources. This also ensures that your account is being kept safe from a potential threat.

Impact

Having the passwords updated frequently allows only the authorized individual to access the AWS resources.

Audit Procedure

Using AWS Console

1. Sign in to AWS Management Console

   • If you do not already have an AWS account, you will need to create one at https://aws.amazon.com.

2. Navigate to Amazon RDS Dashboard

   • Navigate to the RDS service once logged in to the AWS Management Console. You can find this under the Database category.

3. Choose your Aurora DB instance

   • In the RDS Dashboard, click on Databases, and then click on the name of your Aurora DB instance.

4. Modify the instance

   • Click Modify.
   • In the Settings section, enter a new password in the Master password and Confirm password fields.

5. Apply the changes

   • Scroll to the bottom and choose when to apply the changes. You can apply them immediately or schedule them for the next maintenance window.
   • Then, click Continue and Modify DB Instance.

Note: Changing the master password will reboot the DB instance if you apply the change immediately.

Expected Result

The Aurora DB instance master password should be rotated on a regular schedule according to organizational password policies.

Remediation

Follow the audit procedure steps above to rotate Aurora database passwords. Consider using AWS Secrets Manager for automated password rotation.

Default Value

AWS does not enforce automatic password rotation for Aurora database master passwords by default.

References