Project: KICS (Provisioning / Security & Compliance)
File: 9fcd0a0a-9b6f-4670-a215-d94e6bf3f184.md

title: IAM Database Auth Not Enabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 9fcd0a0a-9b6f-4670-a215-d94e6bf3f184 Query name: IAM Database Auth Not Enabled Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Encryption URL: IAM Database Auth Enabled should be configured to true when using compatible engine and version<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="19" AWSTemplateFormatVersion: 2010-09-09 Description: RDS Storage Encrypted Parameters: SourceDBInstanceIdentifier: Type: String DBInstanceType: Type: String SourceRegion: Type: String Resources: MyDBSmall: Type: "AWS::RDS::DBInstance" Properties: DBInstanceClass: db.r3.xlarge SourceDBInstanceIdentifier: !Ref SourceDBInstanceIdentifier SourceRegion: !Ref SourceRegion DeletionProtection: false KmsKeyId: !Ref MyKey EnableIAMDatabaseAuthentication: false Engine: aurora ``` ```json title="Positive test num. 2 - json file" hl_lines="31" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "RDS Storage Encrypted", "Parameters": { "SourceDBInstanceIdentifier": { "Type": "String" }, "DBInstanceType": { "Type": "String" }, "SourceRegion": { "Type": "String" } }, "Resources": { "MyDBSmall": { "Type": "AWS::RDS::DBInstance", "Properties": { "DBInstanceClass": { "Ref": "DBInstanceType" }, "SourceDBInstanceIdentifier": { "Ref": "SourceDBInstanceIdentifier" }, "SourceRegion": { "Ref": "SourceRegion" }, "KmsKeyId": { "Ref": "MyKey" }, "EnableIAMDatabaseAuthentication": false, "Engine": "mysql" } } } } ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="13" AWSTemplateFormatVersion: 2010-09-09 Description: RDS Storage Encrypted Parameters: SourceDBInstanceIdentifier: Type: String DBInstanceType: Type: String SourceRegion: Type: String Resources: MyDBSmall: Type: "AWS::RDS::DBInstance" Properties: DBInstanceClass: db.r3.xlarge SourceDBInstanceIdentifier: !Ref SourceDBInstanceIdentifier SourceRegion: !Ref SourceRegion DeletionProtection: false KmsKeyId: !Ref MyKey Engine: mysql ``` <details><summary>Positive test num. 4 - json file</summary> ```json hl_lines="18" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "RDS Storage Encrypted", "Parameters": { "SourceDBInstanceIdentifier": { "Type": "String" }, "DBInstanceType": { "Type": "String" }, "SourceRegion": { "Type": "String" } }, "Resources": { "MyDBSmall": { "Type": "AWS::RDS::DBInstance", "Properties": { "DBInstanceClass": { "Ref": "DBInstanceType" }, "SourceDBInstanceIdentifier": { "Ref": "SourceDBInstanceIdentifier" }, "SourceRegion": { "Ref": "SourceRegion" }, "KmsKeyId": { "Ref": "MyKey" }, "Engine": "mysql" } } } } ``` </details> ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: 2010-09-09 Description: RDS Storage Encrypted Parameters: SourceDBInstanceIdentifier: Type: String DBInstanceType: Type: String SourceRegion: Type: String Resources: MyDBSmall: Type: "AWS::RDS::DBInstance" Properties: DBInstanceClass: !Ref DBInstanceType SourceDBInstanceIdentifier: !Ref SourceDBInstanceIdentifier SourceRegion: !Ref SourceRegion DeletionProtection: false KmsKeyId: !Ref MyKey EnableIAMDatabaseAuthentication: true ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "RDS Storage Encrypted", "Parameters": { "SourceDBInstanceIdentifier": { "Type": "String" }, "DBInstanceType": { "Type": "String" }, "SourceRegion": { "Type": "String" } }, "Resources": { "MyDBSmall": { "Type": "AWS::RDS::DBInstance", "Properties": { "DBInstanceClass": { "Ref": "DBInstanceType" }, "SourceDBInstanceIdentifier": { "Ref": "SourceDBInstanceIdentifier" }, "SourceRegion": { "Ref": "SourceRegion" }, "KmsKeyId": { "Ref": "MyKey" }, "EnableIAMDatabaseAuthentication" : true } } } } ``` ```yaml title="Negative test num. 3 - yaml file" AWSTemplateFormatVersion: 2010-09-09 Description: RDS Storage Encrypted Parameters: SourceDBInstanceIdentifier: Type: String DBInstanceType: Type: String SourceRegion: Type: String Resources: MyDBSmall: Type: "AWS::RDS::DBInstance" Properties: DBInstanceClass: db.t2.small SourceDBInstanceIdentifier: !Ref SourceDBInstanceIdentifier SourceRegion: !Ref SourceRegion DeletionProtection: false KmsKeyId: !Ref MyKey EnableIAMDatabaseAuthentication: false Engine: aurora ``` <details><summary>Negative test num. 4 - yaml file</summary> ```yaml AWSTemplateFormatVersion: 2010-09-09 Description: RDS Storage Encrypted Parameters: SourceDBInstanceIdentifier: Type: String DBInstanceType: Type: String SourceRegion: Type: String Resources: MyDBSmall: Type: "AWS::RDS::DBInstance" Properties: DBInstanceClass: db.t2.small SourceDBInstanceIdentifier: !Ref SourceDBInstanceIdentifier SourceRegion: !Ref SourceRegion DeletionProtection: false KmsKeyId: !Ref MyKey EnableIAMDatabaseAuthentication: false Engine: mariadb EngineVersion: 10.2.43 ``` </details>