Neptune cluster has IAM authentication enabled

Check ID: neptune_cluster_iam_authentication_enabled
Provider: AWS
Service: neptune
Severity: MEDIUM
Categories: identity-access
Resource type: AwsRdsDbCluster

What this check verifies

Neptune DB clusters are evaluated for IAM database authentication. If this setting is enabled, the cluster supports IAM-based authentication. If disabled, the cluster requires traditional database credentials instead.

Risk

Disabled IAM database authentication weakens confidentiality and integrity of the database.

Static or embedded DB credentials can be stolen or reused, enabling unauthorized queries and data exfiltration
Attackers may bypass centralized access controls, escalate privileges, and move laterally without IAM-based audit trails

Recommendation

Adopt IAM database authentication and centralized identity management to remove static DB credentials and improve auditability.

Enforce least privilege for database roles
Use short-lived credentials, centralized rotation and logging
Apply defense-in-depth and integrate DB access with IAM for accountability

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws neptune modify-db-cluster —db-cluster-identifier <DB_CLUSTER_ID> —enable-iam-database-authentication —apply-immediately

resource "aws_neptune_cluster" "example_resource" {
  cluster_identifier                  = "<DB_CLUSTER_ID>"
  iam_database_authentication_enabled = true  # Enable IAM authentication instead of static DB credentials
}

Resources:
  NeptuneCluster:
    Type: AWS::Neptune::DBCluster
    Properties:
      DBClusterIdentifier: <DB_CLUSTER_ID>
      IamAuthEnabled: true  # Enable IAM authentication instead of static DB credentials

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = neptune_cluster_iam_authentication_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Neptune cluster has deletion protection enabled Neptune cluster has CloudWatch audit logs enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires