All checks
Low
RDS instances should not use a database engine default port
Flags RDS DB instances listening on their engine's default port, the one untargeted scans try first. This is one thin layer, never a substitute for keeping the instance out of public subnets and off open security groups. RDS Custom cannot change its port in place: such an instance clears only when replaced by one on a non-default port.
- service
- RDS
- severity
- Low
- scope
- evaluated in every region
How to fix it
In the console
RDS → Databases → the DB instance → Modify → Connectivity
With the AWS CLI
aws rds modify-db-instance --db-instance-identifier <db-instance-id> --db-port-number <port> --region <region>With Terraform
resource "aws_db_instance" "this" {
instance_class = var.instance_class
port = var.db_port
}See which of your accounts this check is failing on.
Book a demo