Check ID: rds_instance_default_admin
Provider: AWS
Service: rds
Severity: MEDIUM
Categories: identity-access
Resource type: AwsRdsDbInstance

​
What this check verifies

RDS DB instances are evaluated for use of a custom administrator username. The finding identifies instances or clusters where the admin user matches common defaults like admin or postgres (checked at the instance or cluster level).

​
Risk

Using a predictable admin name enables password spraying, credential stuffing, and username enumeration. A successful login can expose data (confidentiality), allow tampering (integrity), and disrupt service (availability). Defaults also attract automated scans targeting known usernames.

​
Recommendation

Adopt a unique, non-default admin username for each database and avoid enabling default accounts.
  • Enforce least privilege with separate admin and app users
  • Use strong, rotated secrets in a manager and prefer IAM DB authentication
  • Restrict network exposure and audit authentication activity

​
Remediation

# Terraform: Create an RDS instance with a non-default master username
resource "aws_db_instance" "<example_resource_name>" {
  engine            = "mysql"
  instance_class    = "db.t3.micro"
  allocated_storage = 20
  username          = "<non_default_username>" # Critical: custom admin username (not "admin" or "postgres")
  password          = "<example_password>"
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = rds_instance_default_admin. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks