Control: 7 Neptune DB clusters should have IAM database authentication enabled
Description
This control checks if a Neptune DB cluster has IAM database authentication enabled. The control fails if IAM database authentication isn't enabled for a Neptune DB cluster.
IAM database authentication for Amazon Neptune database clusters removes the need to store user credentials within the database configuration because authentication is managed externally using IAM. When IAM database authentication is enabled, each request needs to be signed using AWS Signature Version 4.
Remediation
By default, IAM database authentication is disabled when you create a Neptune DB cluster. To enable it, see Enabling IAM database authentication in Neptune in the Neptune User Guide.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.foundational_security_neptune_7Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.foundational_security_neptune_7 --shareSQL
This control uses a named query:
select arn as resource, case when iam_database_authentication_enabled then 'ok' else 'alarm' end as status, case when iam_database_authentication_enabled then title || ' IAM authentication enabled.' else title || ' IAM authentication disabled.' end as reason , region, account_idfrom aws_neptune_db_cluster;