Control: 10 IAM authentication should be configured for RDS instances
Description
This control checks whether an RDS DB instance has IAM database authentication enabled.
IAM database authentication allows authentication to database instances with an authentication token instead of a password. Network traffic to and from the database is encrypted using SSL.
Remediation
To remediate this issue, update your DB instance to enable IAM authentication.
To enable IAM authentication for an existing DB instance
- Open the Amazon RDS console.
- Choose
Databases. - Select the DB instance to modify.
- Choose
Modify. - Under
Database options, chooseEnable IAM DB authentication. - Choose
Continue. - Under
Scheduling of modifications, choose when to apply modifications. The options areApply during the next scheduled maintenance windoworApply immediately. - For clusters, choose
Modify DB Instance.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.foundational_security_rds_10Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.foundational_security_rds_10 --shareSQL
This control uses a named query:
rds_db_instance_iam_authentication_enabled