Lightsail database public access disabled

Check ID: lightsail_database_public
Provider: AWS
Service: lightsail
Severity: HIGH
Categories: internet-exposed
Resource type: Other

What this check verifies

Lightsail managed database is evaluated for public accessibility. When public mode is enabled, the database accepts connections from the Internet using its endpoint and port; otherwise, access is limited to authorized Lightsail resources.

Risk

Publicly reachable databases expose confidential data and credentials to the Internet, enabling:

Brute-force and credential stuffing
Data exfiltration via unauthorized queries
Service disruption from scanning or DoS

Compromise enables lateral movement and tampering, impacting confidentiality, integrity, and availability.

Recommendation

Disable public mode and keep the database reachable only from trusted, private networks.

Enforce least privilege and network segmentation
Use bastion hosts, tunnels, or private endpoints for admin access
If exposure is unavoidable, restrict by IP, rotate credentials, and monitor connections for defense in depth

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws lightsail update-relational-database —relational-database-name <example_resource_name> —no-publicly-accessible

# Disable public access for a Lightsail database
resource "aws_lightsail_database" "<example_resource_name>" {
  name                 = "<example_resource_name>"
  availability_zone    = "<availability_zone>"
  blueprint_id         = "<blueprint_id>"
  bundle_id            = "<bundle_id>"
  master_database_name = "<master_database_name>"
  master_username      = "<master_username>"
  master_password      = "<master_password>"

  publicly_accessible = false  # Critical: ensures the database is not publicly accessible
}

# CloudFormation: disable public access on an existing Lightsail database
Resources:
  <example_resource_name>:
    Type: AWS::Lightsail::Database
    Properties:
      RelationalDatabaseName: <example_resource_name>
      PubliclyAccessible: false  # Critical: turns off public mode so the database is not publicly accessible

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = lightsail_database_public. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

KMS key does not grant access to anonymous principals Lightsail instance has automated snapshots enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires