Project: KICS (Provisioning / Security & Compliance)
File: d9dc6429-5140-498a-8f55-a10daac5f000.md

title: RDS DB Instance Publicly Accessible hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: d9dc6429-5140-498a-8f55-a10daac5f000 Query name: RDS DB Instance Publicly Accessible Platform: Crossplane Severity: <span style="color:#ff7213">Medium</span> Category: Insecure Configurations URL: RDS must not be defined with public interface, which means the attribute 'PubliclyAccessible' must be set to false and neither dbSubnetGroupName' subnets being part of a VPC that has an Internet gateway attached to it<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="7" apiVersion: database.aws.crossplane.io/v1beta1 kind: RDSInstance metadata: name: sample-cluster3 spec: forProvider: publiclyAccessible: true apiVersion: database.aws.crossplane.io/v1alpha3 kind: DBSubnetGroup metadata: name: my-db-subnet-group spec: forProvider: description: "My DB Subnet Group" subnetIds: subnet-12345678 subnet-87654321 ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="11" apiVersion: database.aws.crossplane.io/v1beta1 kind: RDSInstance metadata: name: my-rds-instance spec: forProvider: engine: mysql engineVersion: "8.0" instanceClass: db.t2.micro allocatedStorage: 20 dbSubnetGroupName: my-db-subnet-group writeConnectionSecretToRef: name: my-rds-instance-connection apiVersion: database.aws.crossplane.io/v1alpha3 kind: DBSubnetGroup metadata: name: my-db-subnet-group spec: forProvider: description: "My DB Subnet Group" subnetIds: subnet-12345678 subnet-87654321 apiVersion: ec2.aws.crossplane.io/v1beta1 kind: Subnet metadata: name: subnet-12345678 spec: forProvider: cidrBlock: "10.0.0.0/24" vpcId: vpc-abcdef12 availabilityZone: us-west-2a apiVersion: ec2.aws.crossplane.io/v1beta1 kind: Subnet metadata: name: subnet-87654321 spec: forProvider: cidrBlock: "10.0.0.1/24" vpcId: vpc-abcdef12 availabilityZone: us-west-2a apiVersion: network.aws.crossplane.io/v1alpha3 kind: InternetGateway metadata: name: my-internet-gateway spec: forProvider: vpcId: vpc-abcdef12 ``` ```yaml title="Negative test num. 1 - yaml file" apiVersion: database.aws.crossplane.io/v1beta1 kind: RDSInstance metadata: name: sample-cluster3 spec: forProvider: publiclyAccessible: false apiVersion: database.aws.crossplane.io/v1alpha3 kind: DBSubnetGroup metadata: name: my-db-subnet-group spec: forProvider: description: "My DB Subnet Group" subnetIds: subnet-12345678 subnet-87654321 ``` ```yaml title="Negative test num. 2 - yaml file" apiVersion: database.aws.crossplane.io/v1beta1 kind: RDSInstance metadata: name: my-rds-instance spec: forProvider: engine: mysql engineVersion: "8.0" instanceClass: db.t2.micro allocatedStorage: 20 dbSubnetGroupName: my-db-subnet-group writeConnectionSecretToRef: name: my-rds-instance-connection apiVersion: database.aws.crossplane.io/v1alpha3 kind: DBSubnetGroup metadata: name: my-db-subnet-group spec: forProvider: description: "My DB Subnet Group" subnetIds: subnet-12345678 subnet-87654321 apiVersion: ec2.aws.crossplane.io/v1beta1 kind: Subnet metadata: name: subnet-12345678 spec: forProvider: cidrBlock: "10.0.0.0/24" vpcId: vpc-abcdef12 availabilityZone: us-west-2a apiVersion: ec2.aws.crossplane.io/v1beta1 kind: Subnet metadata: name: subnet-87654321 spec: forProvider: cidrBlock: "10.0.0.1/24" vpcId: vpc-abcdef12 availabilityZone: us-west-2a apiVersion: network.aws.crossplane.io/v1alpha3 kind: InternetGateway metadata: name: my-internet-gateway spec: forProvider: vpcId: vpc-abcdef12345 ```