Control: 12 IAM authentication should be configured for RDS clusters

Description

This control checks whether an RDS DB cluster has IAM database authentication enabled.

IAM database authentication allows for password-free authentication to database instances. The authentication uses an authentication token. Network traffic to and from the database is encrypted using SSL.

Remediation

You can enable IAM authentication for a DB cluster from the Amazon RDS console.

To enable IAM authentication for an existing DB cluster

Open the Amazon RDS console.
Choose Databases.
Choose the DB cluster to modify.
Choose Modify.
Under Database options, select Enable IAM DB authentication.
Choose Continue.
Under Scheduling of modifications, choose when to apply modifications: Apply during the next scheduled maintenance window or Apply immediately.
Choose Modify cluster.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.foundational_security_rds_12

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.foundational_security_rds_12 --share

SQL

This control uses a named query:

select
  arn as resource,
  case
    when iam_database_authentication_enabled then 'ok'
    else 'alarm'
  end as status,
  case
    when iam_database_authentication_enabled then title || ' IAM authentication enabled.'
    else title || ' IAM authentication not enabled.'
  end as reason
  
  , region, account_id
from
  aws_rds_db_cluster;

Control: 12 IAM authentication should be configured for RDS clusters

Description

Remediation

Usage

SQL

Tags