Check Details

• Resource: RDS DB Instance
• Check: Block public access to RDS instance
• Risk: Publicly accessible databases may be exposed to unauthorized access

Remediation via AWS Console

1. Log in to the AWS Management Console and open the Amazon RDS console.

   
2. From the navigation panel, click Databases.
3. Select the RDS instance you want to update.

4. Click Modify from the top menu.

   

5. Scroll to the Connectivity section and expand Additional connectivity configuration. Set Publicly accessible to No.

   

6. Update subnet and route configuration:

   • Under Connectivity & security, click the VPC ID
   • In the VPC page, open Details and click the Route table link
   

7. In the route table:

   • Open the Routes tab
   • Click Edit routes
   • Remove or update any route with target igw-* (Internet Gateway)
   • Click Save routes
   
8. Return to the Modify DB Instance page. Click Continue, choose Apply immediately, and click Modify DB Instance.
9. Repeat these steps for all RDS instances in the current region. Change the AWS region and repeat for other regions.

Remediation via AWS CLI

1. Log in to the AWS Management Console and click the CloudShell icon (>_) in the top-right corner.

   

2. View all RDS instances in a region:

   

   aws rds describe-db-instances \
   --region <region-name> \
   --query 'DBInstances[*].DBInstanceIdentifier'
   

3. Disable public access for the selected RDS instance:

   

   aws rds modify-db-instance \
    --region <region-name> \
    --db-instance-identifier <db-instance-name> \
    --no-publicly-accessible \
    --apply-immediately
   

   Note: Changes related to Internet Gateway removal and routing cannot be completed using AWS CLI. These updates must be performed manually through the AWS Management Console.

   Repeat these steps for all RDS instances in the current region and across all AWS regions used by the account.