Check ID: rds_cluster_default_admin
Provider: AWS
Service: rds
Severity: MEDIUM
Categories: identity-access
Resource type: AwsRdsDbCluster

​
What this check verifies

RDS DB clusters are evaluated for use of a custom administrator username, flagging clusters that use defaults such as admin or postgres.

​
Risk

Using a well-known admin username simplifies credential stuffing and brute-force attempts. Attackers can focus on password guessing, increasing chances of compromise. A successful login enables data theft (confidentiality), unauthorized changes (integrity), and destructive operations or outages (availability).

​
Recommendation

Create databases with a unique, non-default admin username that doesn’t reveal environment or org. Apply least privilege by using separate, non-admin accounts for applications. Prefer IAM database authentication and manage secrets centrally with rotation. Restrict admin access and monitor login attempts.

​
Remediation

# Create an RDS DB cluster with a custom admin username
resource "aws_rds_cluster" "<example_resource_name>" {
  cluster_identifier = "<example_resource_id>"
  engine             = "aurora-mysql"
  master_username    = "<custom_admin_username>" # CRITICAL: non-default username (not admin/postgres)
  master_password    = "<example_password>"
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = rds_cluster_default_admin. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks