IAM authentication should be configured for RDS instances

Checks that RDS for MySQL, MariaDB and PostgreSQL DB instances, and Aurora DB instances, have IAM database authentication enabled, so clients can sign in with short-lived IAM tokens instead of stored passwords. The flag alone moves no one off passwords: each client also needs a database user mapped to IAM and an IAM policy granting rds-db:connect.

service: RDS
severity: Medium
scope: evaluated in every region

How to fix it

In the console

RDS → Databases → the DB instance → Modify

With the AWS CLI

aws rds modify-db-instance --db-instance-identifier <db-instance-id> --enable-iam-database-authentication --region <region>

With Terraform

resource "aws_db_instance" "this" {
  instance_class                      = var.instance_class
  iam_database_authentication_enabled = true
}

See which of your accounts this check is failing on.

Book a demo

IAM authentication should be configured for RDS instances

How to fix it

In the console

With the AWS CLI

With Terraform

More RDS checks