Check ID: neptune_cluster_uses_public_subnet
Provider: AWS
Service: neptune
Severity: MEDIUM
Categories: internet-exposed, trust-boundaries
Resource type: AwsRdsDbCluster

​
What this check verifies

Neptune cluster is associated with one or more public subnets.

​
Risk

A Neptune cluster in a public subnet increases exposure across the CIA triad:
  • Confidentiality: Direct access enables credential attacks and data exfiltration
  • Integrity: Attackers may modify or inject graph data
  • Availability: Public reachability allows DDoS or remote exploitation, causing downtime

​
Recommendation

Place Neptune clusters in private subnets and remove public routability to reduce attack surface.
  • Apply least privilege and network segmentation
  • Restrict inbound access with scoped network controls and minimal trusted paths
  • Enforce logging, monitoring, and private connectivity for administrative and application access

​
Remediation

resource "aws_neptune_subnet_group" "neptune" {
  name       = "neptune-private-subnets"
  subnet_ids = ["<PRIVATE_SUBNET_ID_1>", "<PRIVATE_SUBNET_ID_2>"]  # Use only private subnet IDs to prevent public access
}

resource "aws_neptune_cluster" "example_cluster" {
  neptune_subnet_group_name = aws_neptune_subnet_group.neptune.name  # Associate cluster with private subnet group
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = neptune_cluster_uses_public_subnet. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks