RDS DB Instance Publicly Accessible
- Query id: 647de8aa-5a42-41b5-9faf-22136f117380
- Query name: RDS DB Instance Publicly Accessible
- Platform: Pulumi
- Severity: High
- Category: Insecure Configurations
- URL: Github
Description¶
RDS must not be defined with public interface, which means the attribute 'PubliclyAccessible' must be set to false.
Documentation
Code samples¶
Code samples with security vulnerabilities¶
Postitive test num. 1 - yaml file
name: aws-rds
runtime: yaml
description: An RDS Instance
resources:
default:
type: aws:rds:Instance
properties:
allocatedStorage: 10
dbName: mydb
engine: mysql
engineVersion: '5.7'
instanceClass: db.t3.micro
parameterGroupName: default.mysql5.7
password: foobarbaz
skipFinalSnapshot: true
username: foo
publiclyAccessible: true
Code samples without security vulnerabilities¶
Negative test num. 1 - yaml file
name: aws-rds
runtime: yaml
description: An RDS cluster
resources:
default:
type: aws:rds:Instance
properties:
allocatedStorage: 10
dbName: mydb
engine: mysql
engineVersion: '5.7'
instanceClass: db.t3.micro
parameterGroupName: default.mysql5.7
password: foobarbaz
skipFinalSnapshot: true
username: foo
Negative test num. 2 - yaml file
name: aws-rds
runtime: yaml
description: An RDS Instance
resources:
default:
type: aws:rds:Instance
properties:
allocatedStorage: 10
dbName: mydb
engine: mysql
engineVersion: '5.7'
instanceClass: db.t3.micro
parameterGroupName: default.mysql5.7
password: foobarbaz
skipFinalSnapshot: true
username: foo
publiclyAccessible: false