Description

Detects AWS RDS database instances that are configured to be publicly accessible from the internet. Public database instances can pose a significant security risk by potentially exposing sensitive data to unauthorized access from the internet if not properly secured.

Detection Strategy

• RDS database instance is flagged as publicly accessible through the 'PubliclyAccessible' setting being set to true

• The database instance must be active and running (part of DBInstances list)

• The vulnerability is reported for each individual database instance that has public access enabled