Project: KICS (Provisioning / Security & Compliance)
File: de38e1d5-54cb-4111-a868-6f7722695007.md

title: RDS DB Instance Publicly Accessible hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: de38e1d5-54cb-4111-a868-6f7722695007 Query name: RDS DB Instance Publicly Accessible Platform: CloudFormation Severity: <span style="color:#ff0000">Critical</span> Category: Insecure Configurations URL: RDS must not be defined with public interface, which means the attribute 'PubliclyAccessible' must be set to false.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="69" AWSTemplateFormatVersion: 2010-09-09 Description: >- Description": "AWS CloudFormation Sample Template for creating an Amazon RDS DB instance: Sample template showing how to create a DB instance with Enhanced Monitoring enabled. WARNING This template creates an RDS DB instance. You will be billed for the AWS resources used if you create a stack from this template. Parameters: DBInstanceID: Default: mydbinstance Description: My database instance Type: String MinLength: '1' MaxLength: '63' AllowedPattern: '*' ConstraintDescription: >- Must begin with a letter and must not end with a hyphen or contain two consecutive hyphens. DBName: Default: mydb Description: My database Type: String MinLength: '1' MaxLength: '64' AllowedPattern: '*' ConstraintDescription: Must begin with a letter and contain only alphanumeric characters. DBInstanceClass: Default: db.m5.large Description: DB instance class Type: String ConstraintDescription: Must select a valid DB instance type. DBAllocatedStorage: Default: '50' Description: The size of the database (GiB) Type: Number MinValue: '5' MaxValue: '1024' ConstraintDescription: must be between 20 and 65536 GiB. DBUsername: NoEcho: 'true' Description: Username for MySQL database access Type: String MinLength: '1' MaxLength: '16' AllowedPattern: '*' ConstraintDescription: must begin with a letter and contain only alphanumeric characters. DBPassword: NoEcho: 'true' Description: Password MySQL database access Type: String MinLength: '8' MaxLength: '41' AllowedPattern: '[a-zA-Z0-9]*' ConstraintDescription: must contain only alphanumeric characters. Resources: MyDB: Type: 'AWS::RDS::DBInstance' Properties: DBInstanceIdentifier: !Ref DBInstanceID DBName: !Ref DBName DBInstanceClass: !Ref DBInstanceClass AllocatedStorage: !Ref DBAllocatedStorage Engine: MySQL EngineVersion: 8.0.16 MasterUsername: !Ref DBUsername MasterUserPassword: !Ref DBPassword MonitoringInterval: '60' MonitoringRoleArn: 'arn:aws:iam::123456789012:role/rds-monitoring-role' PubliclyAccessible: true ``` ```json title="Positive test num. 2 - json file" hl_lines="61" { "Description": "Description\": \"AWS CloudFormation Sample Template for creating an Amazon RDS DB instance: Sample template showing how to create a DB instance with Enhanced Monitoring enabled. WARNING This template creates an RDS DB instance. You will be billed for the AWS resources used if you create a stack from this template.", "Parameters": { "DBInstanceClass": { "Description": "DB instance class", "Type": "String", "ConstraintDescription": "Must select a valid DB instance type.", "Default": "db.m5.large" }, "DBAllocatedStorage": { "ConstraintDescription": "must be between 20 and 65536 GiB.", "Default": "50", "Description": "The size of the database (GiB)", "Type": "Number", "MinValue": "5", "MaxValue": "1024" }, "DBUsername": { "MinLength": "1", "MaxLength": "16", "AllowedPattern": "*", "ConstraintDescription": "must begin with a letter and contain only alphanumeric characters.", "NoEcho": "true", "Description": "Username for MySQL database access", "Type": "String" }, "DBPassword": { "Type": "String", "MinLength": "8", "MaxLength": "41", "AllowedPattern": "[a-zA-Z0-9]*", "ConstraintDescription": "must contain only alphanumeric characters.", "NoEcho": "true", "Description": "Password MySQL database access" }, "DBInstanceID": { "Default": "mydbinstance", "Description": "My database instance", "Type": "String", "MinLength": "1", "MaxLength": "63", "AllowedPattern": "*", "ConstraintDescription": "Must begin with a letter and must not end with a hyphen or contain two consecutive hyphens." }, "DBName": { "ConstraintDescription": "Must begin with a letter and contain only alphanumeric

"Default": "mydb", "Description": "My database", "Type": "String", "MinLength": "1", "MaxLength": "64", "AllowedPattern": "*" } }, "Resources": { "MyDB": { "Type": "AWS::RDS::DBInstance", "Properties": { "MasterUsername": "DBUsername", "MasterUserPassword": "DBPassword", "PubliclyAccessible": true, "DBInstanceIdentifier": "DBInstanceID", "DBName": "DBName", "AllocatedStorage": "DBAllocatedStorage", "MonitoringInterval": "60", "MonitoringRoleArn": "arn:aws:iam::123456789012:role/rds-monitoring-role", "DBInstanceClass": "DBInstanceClass", "Engine": "MySQL", "EngineVersion": "8.0.16" } } }, "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z" } ``` ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: 2010-09-09 Description: >- Description": "AWS CloudFormation Sample Template for creating an Amazon RDS DB instance: Sample template showing how to create a DB instance with Enhanced Monitoring enabled. WARNING This template creates an RDS DB instance. You will be billed for the AWS resources used if you create a stack from this template. Parameters: DBInstanceID: Default: mydbinstance Description: My database instance Type: String MinLength: '1' MaxLength: '63' AllowedPattern: '*' ConstraintDescription: >- Must begin with a letter and must not end with a hyphen or contain two consecutive hyphens. DBName: Default: mydb Description: My database Type: String MinLength: '1' MaxLength: '64' AllowedPattern: '*' ConstraintDescription: Must begin with a letter and contain only alphanumeric characters. DBInstanceClass: Default: db.m5.large Description: DB instance class Type: String ConstraintDescription: Must select a valid DB instance type. DBAllocatedStorage: Default: '50' Description: The size of the database (GiB) Type: Number MinValue: '5' MaxValue: '1024' ConstraintDescription: must be between 20 and 65536 GiB. DBUsername: NoEcho: 'true' Description: Username for MySQL database access Type: String MinLength: '1' MaxLength: '16' AllowedPattern: '*' ConstraintDescription: must begin with a letter and contain only alphanumeric characters. DBPassword: NoEcho: 'true' Description: Password MySQL database access Type: String MinLength: '8' MaxLength: '41' AllowedPattern: '[a-zA-Z0-9]*' ConstraintDescription: must contain only alphanumeric characters. Resources: MyDB: Type: 'AWS::RDS::DBInstance' Properties: DBInstanceIdentifier: !Ref DBInstanceID DBName: !Ref DBName DBInstanceClass: !Ref DBInstanceClass AllocatedStorage: !Ref DBAllocatedStorage Engine: MySQL EngineVersion: 8.0.16 MasterUsername: !Ref DBUsername MasterUserPassword: !Ref DBPassword MonitoringInterval: '60' MonitoringRoleArn: 'arn:aws:iam::123456789012:role/rds-monitoring-role' PubliclyAccessible: false ``` ```json title="Negative test num. 2 - json file" { "Resources": { "MyDB": { "Type": "AWS::RDS::DBInstance", "Properties": { "AllocatedStorage": "DBAllocatedStorage", "EngineVersion": "8.0.16", "MasterUserPassword": "DBPassword", "MonitoringInterval": "60", "DBInstanceIdentifier": "DBInstanceID", "DBName": "DBName", "DBInstanceClass": "DBInstanceClass", "Engine": "MySQL", "MasterUsername": "DBUsername", "MonitoringRoleArn": "arn:aws:iam::123456789012:role/rds-monitoring-role", "PubliclyAccessible": false } } }, "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Description": "Description\": \"AWS CloudFormation Sample Template for creating an Amazon RDS DB instance: Sample template showing how to create a DB instance with Enhanced Monitoring enabled. WARNING This template creates an RDS DB instance. You will be billed for the AWS resources used if you create a stack from this template.", "Parameters": { "DBPassword": { "NoEcho": "true", "Description": "Password MySQL database access", "Type": "String", "MinLength": "8", "MaxLength": "41", "AllowedPattern": "[a-zA-Z0-9]*", "ConstraintDescription": "must contain only alphanumeric characters." }, "DBInstanceID": { "MinLength": "1", "MaxLength": "63", "AllowedPattern": "*", "ConstraintDescription": "Must begin with a letter and must not end with a hyphen or contain two consecutive hyphens.", "Default": "mydbinstance", "Description": "My database instance", "Type": "String" }, "DBName": { "Default": "mydb", "Description": "My database", "Type": "String", "MinLength": "1", "MaxLength": "64", "AllowedPattern": "*", "ConstraintDescription": "Must begin with a letter and contain only alphanumeric characters." }, "DBInstanceClass": { "Default": "db.m5.large", "Description": "DB instance class", "Type": "String", "ConstraintDescription": "Must select a valid DB instance type." }, "DBAllocatedStorage": { "Description": "The size of the database (GiB)", "Type": "Number", "MinValue": "5", "MaxValue": "1024", "ConstraintDescription": "must be between 20 and 65536 GiB.", "Default": "50" }, "DBUsername": { "MinLength": "1", "MaxLength": "16", "AllowedPattern": "*", "ConstraintDescription": "must begin with a letter and contain only alphanumeric characters.", "NoEcho": "true", "Description": "Username for MySQL database access", "Type": "String" } } } ```