RDS Associated with Public Subnet
- Query id: 4e88adee-a8eb-4605-a78d-9fb1096e3091
- Query name: RDS Associated with Public Subnet
- Platform: CloudFormation
- Severity: High
- Category: Networking and Firewall
- URL: Github
Description¶
RDS should not run in public subnet
Documentation
Code samples¶
Code samples with security vulnerabilities¶
Postitive test num. 1 - yaml file
Resources:
Positive1:
Type: AWS::RDS::DBInstance
Properties:
AllocatedStorage: '5'
DBInstanceClass: db.t2.small
Engine: oracle-ee
LicenseModel: bring-your-own-license
MasterUsername: master
MasterUserPassword: SecretPassword01
BackupRetentionPeriod: 7
DBSubnetGroupName:
Ref: myDBSubnetGroup
DeletionPolicy: Snapshot
myDBSubnetGroup:
Properties:
DBSubnetGroupDescription: description
SubnetIds:
- Ref: mySubnet1
- Ref: mySubnet2
Tags:
-
Key: String
Value: String
Type: "AWS::RDS::DBSubnetGroup"
mySubnet1:
Type: AWS::EC2::Subnet
Properties:
VpcId:
Ref: myVPC
CidrBlock: 10.0.0.0/24
AvailabilityZone: "us-east-1a"
Tags:
- Key: stack
Value: production
mySubnet2:
Type: AWS::EC2::Subnet
Properties:
VpcId:
Ref: myVPC
CidrBlock: 0.0.0.0/0
AvailabilityZone: "us-east-1a"
Tags:
- Key: stack
Value: production
Postitive test num. 2 - json file
{
"Resources": {
"Positive1": {
"DeletionPolicy": "Snapshot",
"Properties": {
"AllocatedStorage": "5",
"BackupRetentionPeriod": 7,
"DBInstanceClass": "db.t2.small",
"DBSubnetGroupName": {
"Ref": "myDBSubnetGroup"
},
"Engine": "oracle-ee",
"LicenseModel": "bring-your-own-license",
"MasterUserPassword": "SecretPassword01",
"MasterUsername": "master"
},
"Type": "AWS::RDS::DBInstance"
},
"myDBSubnetGroup": {
"Properties": {
"DBSubnetGroupDescription": "description",
"SubnetIds": [
{
"Ref": "mySubnet1"
},
{
"Ref": "mySubnet2"
}
],
"Tags": [
{
"Key": "String",
"Value": "String"
}
]
},
"Type": "AWS::RDS::DBSubnetGroup"
},
"mySubnet1": {
"Properties": {
"AvailabilityZone": "us-east-1a",
"CidrBlock": "10.0.0.0/24",
"Tags": [
{
"Key": "stack",
"Value": "production"
}
],
"VpcId": {
"Ref": "myVPC"
}
},
"Type": "AWS::EC2::Subnet"
},
"mySubnet2": {
"Properties": {
"AvailabilityZone": "us-east-1a",
"CidrBlock": "0.0.0.0/0",
"Tags": [
{
"Key": "stack",
"Value": "production"
}
],
"VpcId": {
"Ref": "myVPC"
}
},
"Type": "AWS::EC2::Subnet"
}
}
}
Code samples without security vulnerabilities¶
Negative test num. 1 - yaml file
Resources:
Negative1:
Type: AWS::RDS::DBInstance
Properties:
AllocatedStorage: '5'
DBInstanceClass: db.t2.small
Engine: oracle-ee
LicenseModel: bring-your-own-license
MasterUsername: master
MasterUserPassword: SecretPassword01
BackupRetentionPeriod: 7
DBSubnetGroupName:
Ref: myDBSubnetGroup0
DeletionPolicy: Snapshot
myDBSubnetGroup0:
Properties:
DBSubnetGroupDescription: description
SubnetIds:
- Ref: mySubnet10
Tags:
-
Key: String
Value: String
Type: "AWS::RDS::DBSubnetGroup"
mySubnet10:
Type: AWS::EC2::Subnet
Properties:
VpcId:
Ref: myVPC
CidrBlock: 10.0.0.0/24
AvailabilityZone: "us-east-1a"
Tags:
- Key: stack
Value: production
Negative test num. 2 - json file
{
"Resources": {
"Negative1": {
"DeletionPolicy": "Snapshot",
"Properties": {
"AllocatedStorage": "5",
"BackupRetentionPeriod": 7,
"DBInstanceClass": "db.t2.small",
"DBSubnetGroupName": {
"Ref": "myDBSubnetGroup0"
},
"Engine": "oracle-ee",
"LicenseModel": "bring-your-own-license",
"MasterUserPassword": "SecretPassword01",
"MasterUsername": "master"
},
"Type": "AWS::RDS::DBInstance"
},
"myDBSubnetGroup0": {
"Properties": {
"DBSubnetGroupDescription": "description",
"SubnetIds": [
{
"Ref": "mySubnet10"
}
],
"Tags": [
{
"Key": "String",
"Value": "String"
}
]
},
"Type": "AWS::RDS::DBSubnetGroup"
},
"mySubnet10": {
"Properties": {
"AvailabilityZone": "us-east-1a",
"CidrBlock": "10.0.0.0/24",
"Tags": [
{
"Key": "stack",
"Value": "production"
}
],
"VpcId": {
"Ref": "myVPC"
}
},
"Type": "AWS::EC2::Subnet"
}
}
}