Project: KICS (Provisioning / Security & Compliance)
File: 4e88adee-a8eb-4605-a78d-9fb1096e3091.md

title: RDS Associated with Public Subnet hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 4e88adee-a8eb-4605-a78d-9fb1096e3091 Query name: RDS Associated with Public Subnet Platform: CloudFormation Severity: <span style="color:#ff0000">Critical</span> Category: Networking and Firewall URL: RDS should not run in public subnet<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="12" Resources: Positive1: Type: AWS::RDS::DBInstance Properties: AllocatedStorage: '5' DBInstanceClass: db.t2.small Engine: oracle-ee LicenseModel: bring-your-own-license MasterUsername: master MasterUserPassword: SecretPassword01 BackupRetentionPeriod: 7 DBSubnetGroupName: Ref: myDBSubnetGroup DeletionPolicy: Snapshot myDBSubnetGroup: Properties: DBSubnetGroupDescription: description SubnetIds: Ref: mySubnet1 Ref: mySubnet2 Tags: Key: String Value: String Type: "AWS::RDS::DBSubnetGroup" mySubnet1: Type: AWS::EC2::Subnet Properties: VpcId: Ref: myVPC CidrBlock: 10.0.0.0/24 AvailabilityZone: "us-east-1a" Tags: Key: stack Value: production mySubnet2: Type: AWS::EC2::Subnet Properties: VpcId: Ref: myVPC CidrBlock: 0.0.0.0/0 AvailabilityZone: "us-east-1a" Tags: Key: stack Value: production ``` ```json title="Positive test num. 2 - json file" hl_lines="9" { "Resources": { "Positive1": { "DeletionPolicy": "Snapshot", "Properties": { "AllocatedStorage": "5", "BackupRetentionPeriod": 7, "DBInstanceClass": "db.t2.small", "DBSubnetGroupName": { "Ref": "myDBSubnetGroup" }, "Engine": "oracle-ee", "LicenseModel": "bring-your-own-license", "MasterUserPassword": "SecretPassword01", "MasterUsername": "master" }, "Type": "AWS::RDS::DBInstance" }, "myDBSubnetGroup": { "Properties": { "DBSubnetGroupDescription": "description", "SubnetIds": [ { "Ref": "mySubnet1" }, { "Ref": "mySubnet2" } ], "Tags": [ { "Key": "String", "Value": "String" } ] }, "Type": "AWS::RDS::DBSubnetGroup" }, "mySubnet1": { "Properties": { "AvailabilityZone": "us-east-1a", "CidrBlock": "10.0.0.0/24", "Tags": [ { "Key": "stack", "Value": "production" } ], "VpcId": { "Ref": "myVPC" } }, "Type": "AWS::EC2::Subnet" }, "mySubnet2": { "Properties": { "AvailabilityZone": "us-east-1a", "CidrBlock": "0.0.0.0/0", "Tags": [ { "Key": "stack", "Value": "production" } ], "VpcId": { "Ref": "myVPC" } }, "Type": "AWS::EC2::Subnet" } } } ``` ```yaml title="Negative test num. 1 - yaml file" Resources: Negative1: Type: AWS::RDS::DBInstance Properties: AllocatedStorage: '5' DBInstanceClass: db.t2.small Engine: oracle-ee LicenseModel: bring-your-own-license MasterUsername: master MasterUserPassword: SecretPassword01 BackupRetentionPeriod: 7 DBSubnetGroupName: Ref: myDBSubnetGroup0 DeletionPolicy: Snapshot myDBSubnetGroup0: Properties: DBSubnetGroupDescription: description SubnetIds: Ref: mySubnet10 Tags: Key: String Value: String Type: "AWS::RDS::DBSubnetGroup" mySubnet10: Type: AWS::EC2::Subnet Properties: VpcId: Ref: myVPC CidrBlock: 10.0.0.0/24 AvailabilityZone: "us-east-1a" Tags: Key: stack Value: production ``` ```json title="Negative test num. 2 - json file" { "Resources": { "Negative1": { "DeletionPolicy": "Snapshot", "Properties": { "AllocatedStorage": "5", "BackupRetentionPeriod": 7, "DBInstanceClass": "db.t2.small", "DBSubnetGroupName": { "Ref": "myDBSubnetGroup0" }, "Engine": "oracle-ee", "LicenseModel": "bring-your-own-license", "MasterUserPassword": "SecretPassword01", "MasterUsername": "master" }, "Type": "AWS::RDS::DBInstance" }, "myDBSubnetGroup0": { "Properties": { "DBSubnetGroupDescription": "description", "SubnetIds": [ { "Ref": "mySubnet10" } ], "Tags": [ { "Key": "String", "Value": "String" } ] }, "Type": "AWS::RDS::DBSubnetGroup" }, "mySubnet10": { "Properties": { "AvailabilityZone": "us-east-1a", "CidrBlock": "10.0.0.0/24", "Tags": [ { "Key": "stack", "Value": "production" } ], "VpcId": { "Ref": "myVPC" } }, "Type": "AWS::EC2::Subnet" } } } ```