logo

Database

Json Yaml Publicly Accessible True

Description

Identifies AWS RDS database instances and clusters that are configured to be publicly accessible from the internet in CloudFormation templates. Public database exposure creates significant security risks by allowing potential attackers direct access to database endpoints.

Weakness:

073 - Improper authorization control for web services - RDS

Category: Functionality Abuse

Detection Strategy

    • Scan CloudFormation template files for RDS resource definitions (DBInstance or DBCluster)

    • Check if the resource has PubliclyAccessible property set to true

    • Report a security issue if a database resource is configured for public access

    • Specifically look for resources of type AWS::RDS::DBCluster or AWS::RDS::DBInstance

Vulnerable code example

Resources:
  MyDatabaseCluster:
    Type: AWS::RDS::DBCluster
    Properties:
      MasterUsername: admin
      MasterUserPassword: password123
      Engine: aurora-mysql
      PubliclyAccessible: true  # VULNERABLE: Exposes DB cluster to public internet...

✅ Secure code example

Resources:
  MyDatabaseCluster:
    Type: AWS::RDS::DBCluster
    Properties:
      MasterUsername: !Sub '{{resolve:secretsmanager:${AWS::StackName}-db-creds:SecretString:username}}'  # Store credentials in Secrets Manager
      MasterUserPassword: !Sub '{{resolve:secretsmanager:${AWS::StackName}-db-creds:SecretString:password}}'
      Engine: aurora-mysql
      PubliclyAccessible: false  # Prevent public internet access...