RDS-01: RDS/Aurora state database security¶
| Property | Value |
|---|---|
| Severity | high |
| Platform | AWS Nitro Enclaves |
| Lifecycle stage | deploy |
| Mode | Passive: read-only cloud API calls. |
What it checks¶
It passes when:
- DB is CMK-encrypted, private, IAM-authenticated, deletion-protected, with no public snapshots.
How to fix¶
- Encrypt storage with a customer-managed KMS CMK; set PubliclyAccessible=false and remove 0.0.0.0/0 ingress; enable IAM database authentication and deletion protection; and ensure no snapshot is shared with 'all'.
After the fix, scan again: the check should report PASS.
When it is not assessed¶
SKIP:
- No DB instance specified; skipping check.
ERROR:
- DB instance … not found.
- Could not describe DB instance: …
Scan inputs¶
The untrust scan options this check reads:
| Option | Description |
|---|---|
--db-instance |
RDS/Aurora DB instance identifier holding enclave state. |
--region |
AWS region. |
Permissions¶
The cloud API calls this check makes, read from the scanner's source:
| Cloud | API call | Permission | Access |
|---|---|---|---|
| AWS | ec2.describe_security_groups |
ec2:DescribeSecurityGroups |
read |
| AWS | kms.describe_key |
kms:DescribeKey |
read |
| AWS | rds.describe_db_instances |
rds:DescribeDBInstances |
read |
| AWS | rds.describe_db_snapshot_attributes |
rds:DescribeDBSnapshotAttributes |
read |
| AWS | rds.describe_db_snapshots |
rds:DescribeDBSnapshots |
read |
Every AWS scan also calls sts:GetCallerIdentity. See Required permissions for a complete policy.
Generated from untrust 1.3.0 (commit 7ef462d9a0c3).