Project: KICS (Provisioning / Security & Compliance)
File: 1fe9d958-ddce-4228-a124-05265a959a8b.md

title: RDS Using Default Port hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 1fe9d958-ddce-4228-a124-05265a959a8b Query name: RDS Using Default Port Platform: CloudFormation Severity: <span style="color:#edd57e">Low</span> Category: Networking and Firewall URL: RDS should not use the default port (an attacker can easily guess the port). For engines related to Aurora, MariaDB or MySQL, the default port is 3306. PostgreSQL default port is 5432, Oracle default port is 1521 and SQL Server default port is 1433<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="15" Resources: MyDB: Type: AWS::RDS::DBInstance Properties: DBSecurityGroups: Ref: MyDbSecurityByEC2SecurityGroup Ref: MyDbSecurityByCIDRIPGroup AllocatedStorage: '5' DBInstanceClass: db.t2.small Engine: oracle-ee LicenseModel: bring-your-own-license MasterUsername: master MasterUserPassword: SecretPassword01 BackupRetentionPeriod: 7 Port: 1521 DeletionPolicy: Snapshot ``` ```json title="Positive test num. 2 - json file" hl_lines="21" { "Resources": { "MyDB": { "Type": "AWS::RDS::DBInstance", "Properties": { "BackupRetentionPeriod": 7, "DBSecurityGroups": [ { "Ref": "MyDbSecurityByEC2SecurityGroup" }, { "Ref": "MyDbSecurityByCIDRIPGroup" } ], "AllocatedStorage": "5", "DBInstanceClass": "db.t2.small", "Engine": "oracle-ee", "LicenseModel": "bring-your-own-license", "MasterUsername": "master", "MasterUserPassword": "SecretPassword01", "Port": 1521 }, "DeletionPolicy": "Snapshot" } } } ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="15" Resources: MyDB: Type: AWS::RDS::DBInstance Properties: DBSecurityGroups: Ref: MyDbSecurityByEC2SecurityGroup Ref: MyDbSecurityByCIDRIPGroup AllocatedStorage: '5' DBInstanceClass: db.t2.small Engine: mysql LicenseModel: bring-your-own-license MasterUsername: master MasterUserPassword: SecretPassword01 BackupRetentionPeriod: 7 Port: 3306 DeletionPolicy: Snapshot ``` <details><summary>Positive test num. 4 - json file</summary> ```json hl_lines="21" { "Resources": { "MyDB": { "Type": "AWS::RDS::DBInstance", "Properties": { "BackupRetentionPeriod": 7, "DBSecurityGroups": [ { "Ref": "MyDbSecurityByEC2SecurityGroup" }, { "Ref": "MyDbSecurityByCIDRIPGroup" } ], "AllocatedStorage": "5", "DBInstanceClass": "db.t2.small", "Engine": "mysql", "LicenseModel": "bring-your-own-license", "MasterUsername": "master", "MasterUserPassword": "SecretPassword01", "Port": 3306 }, "DeletionPolicy": "Snapshot" } } } ``` </details> ```yaml title="Negative test num. 1 - yaml file" Resources: MyDB: Type: AWS::RDS::DBInstance Properties: DBSecurityGroups: Ref: MyDbSecurityByEC2SecurityGroup Ref: MyDbSecurityByCIDRIPGroup AllocatedStorage: '5' DBInstanceClass: db.t2.small Engine: oracle-ee LicenseModel: bring-your-own-license MasterUsername: master MasterUserPassword: SecretPassword01 BackupRetentionPeriod: 7 Port: 1522 DeletionPolicy: Snapshot ``` ```json title="Negative test num. 2 - json file" { "Resources": { "MyDB": { "Type": "AWS::RDS::DBInstance", "Properties": { "BackupRetentionPeriod": 7, "DBSecurityGroups": [ { "Ref": "MyDbSecurityByEC2SecurityGroup" }, { "Ref": "MyDbSecurityByCIDRIPGroup" } ], "AllocatedStorage": "5", "DBInstanceClass": "db.t2.small", "Engine": "oracle-ee", "LicenseModel": "bring-your-own-license", "MasterUsername": "master", "MasterUserPassword": "SecretPassword01", "Port": 1522 }, "DeletionPolicy": "Snapshot" } } } ``` ```yaml title="Negative test num. 3 - yaml file" Resources: MyDB: Type: AWS::RDS::DBInstance Properties: DBSecurityGroups: Ref: MyDbSecurityByEC2SecurityGroup Ref: MyDbSecurityByCIDRIPGroup AllocatedStorage: '5' DBInstanceClass: db.t2.small Engine: mysql LicenseModel: bring-your-own-license MasterUsername: master MasterUserPassword: SecretPassword01 BackupRetentionPeriod: 7 Port: 3307 DeletionPolicy: Snapshot ``` <details><summary>Negative test num. 4 - json file</summary> ```json { "Resources": { "MyDB": { "Type": "AWS::RDS::DBInstance", "Properties": { "BackupRetentionPeriod": 7, "DBSecurityGroups": [ { "Ref": "MyDbSecurityByEC2SecurityGroup" }, { "Ref": "MyDbSecurityByCIDRIPGroup" } ], "AllocatedStorage": "5", "DBInstanceClass": "db.t2.small", "Engine": "mysql", "LicenseModel": "bring-your-own-license", "MasterUsername": "master", "MasterUserPassword": "SecretPassword01", "Port": 3307 }, "DeletionPolicy": "Snapshot" } } } ``` </details>