Project: KICS (Provisioning / Security & Compliance)
File: 88fd05e0-ac0e-43d2-ba6d-fc0ba60ae1a6.md

title: IAM Database Auth Not Enabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 88fd05e0-ac0e-43d2-ba6d-fc0ba60ae1a6 Query name: IAM Database Auth Not Enabled Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Encryption URL: IAM Database Auth Enabled should be configured to true when using compatible engine and version<br> ```tf title="Positive test num. 1 - tf file" hl_lines="10" resource "awsdbinstance" "positive1" { allocated_storage = 20 storage_type = "gp2" engine = "mysql" engine_version = "8.0" instance_class = "db.t2.micro" name = "mydb" username = "foo" password = "foobarbaz" iamdatabaseauthentication_enabled = false } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="1" resource "awsdbinstance" "positive1" { allocated_storage = 20 storage_type = "gp2" engine = "mysql" engine_version = "8.0" instance_class = "db.t2.micro" name = "mydb" username = "foo" password = "foobarbaz" } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="1" module "db" { source = "terraform-aws-modules/rds/aws" version = "~> 3.0" identifier = "demodb" engine = "mysql" engine_version = "8.0" instance_class = "db.t2.large" allocated_storage = 5 name = "demodb" username = "user" password = "YourPwdShouldBeLongAndSecure!" port = "3306" vpcsecuritygroup_ids = ["sg-12345678"] maintenance_window = "Mon:00:00-Mon:03:00" backup_window = "03:00-06:00" monitoring_interval = "30" monitoringrolename = "MyRDSMonitoringRole" createmonitoringrole = true tags = { Owner = "user" Environment = "dev" } subnet_ids = ["subnet-12345678", "subnet-87654321"] family = "mysql5.7" majorengineversion = "5.7" deletion_protection = true parameters = [ { name = "charactersetclient" value = "utf8mb4" }, { name = "charactersetserver" value = "utf8mb4" } ] options = [ { optionname = "MARIADBAUDIT_PLUGIN" option_settings = [ { name = "SERVERAUDITEVENTS" value = "CONNECT" }, { name = "SERVERAUDITFILE_ROTATIONS" value = "37" }, ] }, ] } ``` <details><summary>Positive test num. 4 - tf file</summary> ```tf hl_lines="17" module "db" { source = "terraform-aws-modules/rds/aws" version = "~> 3.0" identifier = "demodb" engine = "mysql" engine_version = "8.0.28" instance_class =

allocated_storage = 5 name = "demodb" username = "user" password = "YourPwdShouldBeLongAndSecure!" port = "3306" iamdatabaseauthentication_enabled = false vpcsecuritygroup_ids = ["sg-12345678"] maintenance_window = "Mon:00:00-Mon:03:00" backup_window = "03:00-06:00" monitoring_interval = "30" monitoringrolename = "MyRDSMonitoringRole" createmonitoringrole = true tags = { Owner = "user" Environment = "dev" } subnet_ids = ["subnet-12345678", "subnet-87654321"] family = "mysql5.7" majorengineversion = "5.7" deletion_protection = true parameters = [ { name = "charactersetclient" value = "utf8mb4" }, { name = "charactersetserver" value = "utf8mb4" } ] options = [ { optionname = "MARIADBAUDIT_PLUGIN" option_settings = [ { name = "SERVERAUDITEVENTS" value = "CONNECT" }, { name = "SERVERAUDITFILE_ROTATIONS" value = "37" }, ] }, ] } ``` </details> ```tf title="Negative test num. 1 - tf file" resource "awsdbinstance" "negative1" { allocated_storage = 20 storage_type = "gp2" engine = "mysql" engine_version = "5.7" instance_class = "db.t2.micro" name = "mydb" username = "foo" password = "foobarbaz" iamdatabaseauthentication_enabled = true } ``` ```tf title="Negative test num. 2 - tf file" module "db" { source = "terraform-aws-modules/rds/aws" version = "~> 3.0" identifier = "demodb" engine = "mysql" engine_version = "5.7.19" instance_class = "db.t2.large" allocated_storage = 5 name = "demodb" username = "user" password = "YourPwdShouldBeLongAndSecure!" port = "3306" iamdatabaseauthentication_enabled = true vpcsecuritygroup_ids = ["sg-12345678"] maintenance_window = "Mon:00:00-Mon:03:00" backup_window = "03:00-06:00" monitoring_interval = "30" monitoringrolename = "MyRDSMonitoringRole" createmonitoringrole = true tags = { Owner = "user" Environment = "dev" } subnet_ids = ["subnet-12345678", "subnet-87654321"] family = "mysql5.7" majorengineversion = "5.7" deletion_protection = true parameters = [ { name = "charactersetclient" value = "utf8mb4" }, { name = "charactersetserver" value = "utf8mb4" } ] options = [ { optionname = "MARIADBAUDIT_PLUGIN" option_settings = [ { name = "SERVERAUDITEVENTS" value = "CONNECT" }, { name = "SERVERAUDITFILE_ROTATIONS" value = "37" }, ] }, ] } ``` ```tf title="Negative test num. 3 - tf file" module "db" { source = "terraform-aws-modules/rds/aws" version = "~> 3.0" identifier = "demodb" engine = "aurora" engine_version = "11.10" instance_class = "db.t2.small" allocated_storage = 5 name = "demodb" username = "user" port = "3306" vpcsecuritygroup_ids = ["sg-12345678"] maintenance_window = "Mon:00:00-Mon:03:00" backup_window = "03:00-06:00" monitoring_interval = "30" monitoringrolename = "MyRDSMonitoringRole" createmonitoringrole = true tags = { Owner = "user" Environment = "dev" } } ``` <details><summary>Negative test num. 4 - tf file</summary> ```tf resource "awsdbinstance" "positive1" { allocated_storage = 20 storage_type = "gp2" engine = "mariadb" engine_version = "10.2.43" instance_class = "db.t2.micro" name = "mydb" username = "foo" password = "foobarbaz" } ``` </details>