turbot/aws_perimeter

Control: RDS DB cluster snapshots should not be publicly restorable

Description

This control checks whether RDS DB cluster snapshots prohibit access to other accounts. It is recommended that your RDS cluster snapshots should not be public in order to prevent potential leak or misuse of sensitive data or any other kind of security threat. If your RDS cluster snapshot is public; then the data which is backed up in that snapshot is accessible to all other AWS accounts.

Usage

Run the control in your terminal:

powerpipe control run aws_perimeter.control.rds_db_cluster_snapshot_prohibit_public_access

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_perimeter.control.rds_db_cluster_snapshot_prohibit_public_access --share

Steampipe Tables

SQL

select
arn as resource,
case
when cluster_snapshot -> 'AttributeValues' = '["all"]' then 'alarm'
else 'ok'
end status,
case
when cluster_snapshot -> 'AttributeValues' = '["all"]' then title || ' publicly restorable.'
else title || ' not publicly restorable.'
end reason
, region, account_id
from
aws_rds_db_cluster_snapshot,
jsonb_array_elements(db_cluster_snapshot_attributes) as cluster_snapshot;

Tags