Description

Detects AWS RDS database instances that are configured to be publicly accessible from the internet through the 'publicly_accessible' parameter. Public database instances can be accessed directly from the internet, potentially exposing sensitive data if not properly secured with additional controls.

Detection Strategy

• Scans Terraform configuration files for AWS RDS resources (aws_rds_cluster_instance or aws_db_instance)

• Checks if the 'publicly_accessible' attribute is explicitly set to 'true'

• Reports a security finding when an RDS instance is configured to allow public access

• Applies to both standard RDS instances (aws_db_instance) and Aurora cluster instances (aws_rds_cluster_instance)

Vulnerable code example

# AWS RDS instance with public accessibility enabled (security risk)
resource "aws_db_instance" "vulnerable_db" {
  publicly_accessible = true  # VULNERABLE: Exposing database instance directly to internet
  instance_class     = "db.t3.micro"
  engine            = "mysql"
  identifier        = "mydb"
}
...

✅ Secure code example

# AWS RDS instance with public accessibility disabled (secure)
resource "aws_db_instance" "secure_db" {
  publicly_accessible = false  # SECURE: Database only accessible from within VPC
  instance_class     = "db.t3.micro"
  engine            = "mysql"
  identifier        = "mydb"
  vpc_security_group_ids = [aws_security_group.db_sg.id]  # SECURE: Restrict access using security group
}...