RDS cluster has IAM authentication enabled

Check ID: rds_cluster_iam_authentication_enabled
Provider: AWS
Service: rds
Severity: MEDIUM
Categories: identity-access
Resource type: AwsRdsDbCluster

What this check verifies

RDS DB clusters on supported engines (MySQL/MariaDB/PostgreSQL/Aurora) have IAM database authentication enabled for database logins, indicating token-based access managed by IAM instead of static passwords.

Risk

Without IAM DB authentication, databases depend on long-lived passwords. Stolen or reused creds can enable unauthorized connections, data exfiltration, and tampering, harming confidentiality and integrity. Lacking short-lived tokens and centralized revocation expands blast radius and weakens access control.

Recommendation

Enable IAM database authentication on supported clusters and enforce least privilege. Grant only necessary rds-db:connect permissions to specific principals, prefer role-based access for workloads to obtain short-lived tokens, require TLS, and deprecate static DB passwords. Pair with auditing and segmentation for defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws rds modify-db-cluster —db-cluster-identifier <DB_CLUSTER_ID> —enable-iam-database-authentication —apply-immediately

# Enable IAM authentication on an existing RDS/Aurora cluster
resource "aws_rds_cluster" "<example_resource_name>" {
  cluster_identifier                   = "<example_resource_id>"
  iam_database_authentication_enabled = true  # Critical: enables IAM DB auth so the check passes
}

# CloudFormation: Enable IAM authentication on an existing RDS/Aurora DB Cluster
Resources:
  <example_resource_name>:
    Type: AWS::RDS::DBCluster
    Properties:
      EnableIAMDatabaseAuthentication: true  # Critical: turns on IAM DB auth for the cluster

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = rds_cluster_iam_authentication_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

RDS cluster has deletion protection enabled RDS cluster has CloudWatch Logs export enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires