All checks
Critical
RDS DB Instances should prohibit public access, as determined by the PubliclyAccessible configuration
Flags RDS DB instances with PubliclyAccessible set, which gives the instance a public IP address and an endpoint that resolves to it from outside the VPC. Only network controls, such as its subnet routes and security group, then stand between the database and the internet.
- service
- RDS
- severity
- Critical
- scope
- evaluated in every region
How to fix it
In the console
RDS → Databases → the DB instance → Modify
With the AWS CLI
aws rds modify-db-instance --db-instance-identifier <db-instance-id> --no-publicly-accessible --region <region>With Terraform
resource "aws_db_instance" "this" {
instance_class = var.instance_class
publicly_accessible = false
}See which of your accounts this check is failing on.
Book a demo