Control: 18 RDS instances should be deployed in a VPC

Description

This control checks whether an RDS instance is deployed in a VPC (EC2-VPC).

VPCs provide a number of network controls to secure access to RDS resources. These controls include VPC Endpoints, network ACLs, and security groups. To take advantage of these controls, we recommend that you move EC2-Classic RDS instances to EC2-VPC.

Remediation

For detailed instructions on how to move RDS instances to VPC, see Updating the VPC for a DB instance in the Amazon RDS User Guide.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.foundational_security_rds_18

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.foundational_security_rds_18 --share

SQL

This control uses a named query:

select
  arn as resource,
  case
    when vpc_id is null then 'alarm'
    else 'ok'
  end as status,
  case
    when vpc_id is null then title || ' is not in VPC.'
    else title || ' is in VPC ' || vpc_id || '.'
  end as reason
  
  , region, account_id
from
  aws_rds_db_instance;

Control: 18 RDS instances should be deployed in a VPC

Description

Remediation

Usage

SQL

Tags