Project: KICS (Provisioning / Security & Compliance)
File: 2cb674f6-32f9-40be-97f2-62c0dc38f0d5.md

title: RDS Using Default Port hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 2cb674f6-32f9-40be-97f2-62c0dc38f0d5 Query name: RDS Using Default Port Platform: Ansible Severity: <span style="color:#edd57e">Low</span> Category: Networking and Firewall URL: RDS should not use the default port (an attacker can easily guess the port). For engines related to Aurora, MariaDB or MySQL, the default port is 3306. PostgreSQL default port is 5432, Oracle default port is 1521 and SQL Server default port is 1433<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="10" name: create minimal aurora instance in default VPC and default subnet group community.aws.rds_instance: engine: aurora dbinstanceidentifier: ansible-test-aurora-db-instance instance_type: db.t2.small password: "{{ password }}" username: "{{ username }}" clusterid: ansible-test-cluster # This cluster must exist - see rdscluster to manage it backupretentionperiod: 7 port: 3306 ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="10" name: create minimal aurora instance in default VPC and default subnet group2 community.aws.rds_instance: engine: postgres dbinstanceidentifier: ansible-test-aurora-db-instance instance_type: db.t2.small password: "{{ password }}" username: "{{ username }}" clusterid: ansible-test-cluster # This cluster must exist - see rdscluster to manage it backupretentionperiod: 7 port: 5432 ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="10" name: create minimal aurora instance in default VPC and default subnet group2 community.aws.rds_instance: engine: oracle-ee dbinstanceidentifier: ansible-test-aurora-db-instance instance_type: db.t2.small password: "{{ password }}" username: "{{ username }}" clusterid: ansible-test-cluster # This cluster must exist - see rdscluster to manage it backupretentionperiod: 7 port: 1521 ``` <details><summary>Positive test num. 4 - yaml file</summary> ```yaml hl_lines="10" name: create minimal aurora instance in default VPC and default subnet group2 community.aws.rds_instance: engine: sqlserver-ee dbinstanceidentifier: ansible-test-aurora-db-instance instance_type: db.t2.small password: "{{ password }}" username: "{{ username }}" clusterid: ansible-test-cluster # This cluster must exist - see rdscluster to manage it backupretentionperiod: 7 port: 1433 ``` </details> ```yaml title="Negative test num. 1 - yaml file" name: create minimal aurora instance in default VPC and default subnet group community.aws.rds_instance: engine: aurora dbinstanceidentifier: ansible-test-aurora-db-instance instance_type: db.t2.small password: "{{ password }}" username: "{{ username }}" clusterid: ansible-test-cluster # This cluster must exist - see rdscluster to manage it backupretentionperiod: 7 port: 3307 ``` ```yaml title="Negative test num. 2 - yaml file" name: create minimal aurora instance in default VPC and default subnet group2 community.aws.rds_instance: engine: postgres dbinstanceidentifier: ansible-test-aurora-db-instance instance_type: db.t2.small password: "{{ password }}" username: "{{ username }}" clusterid: ansible-test-cluster # This cluster must exist - see rdscluster to manage it backupretentionperiod: 7 port: 5433 ``` ```yaml title="Negative test num. 3 - yaml file" name: create minimal aurora instance in default VPC and default subnet group2 community.aws.rds_instance: engine: oracle-ee dbinstanceidentifier: ansible-test-aurora-db-instance instance_type: db.t2.small password: "{{ password }}" username: "{{ username }}" clusterid: ansible-test-cluster # This cluster must exist - see rdscluster to manage it backupretentionperiod: 7 port: 1522 ``` <details><summary>Negative test num. 4 - yaml file</summary> ```yaml name: create minimal aurora instance in default VPC and default subnet group2 community.aws.rds_instance: engine: sqlserver-ee dbinstanceidentifier: ansible-test-aurora-db-instance instance_type: db.t2.small password: "{{ password }}" username: "{{ username }}" clusterid: ansible-test-cluster # This cluster must exist - see rdscluster to manage it backupretentionperiod: 7 port: 1434 ``` </details>