RDS instance has IAM database authentication enabled

Check ID: rds_instance_iam_authentication_enabled
Provider: AWS
Service: rds
Severity: MEDIUM
Categories: identity-access
Resource type: AwsRdsDbInstance

What this check verifies

RDS DB instances using MySQL, MariaDB, or PostgreSQL engines (including Aurora variants) have IAM database authentication enabled at the instance level or, when part of a cluster, evaluated for cluster-level enablement.

Risk

Absent IAM-based, short-lived tokens, databases rely on static passwords in code and configs, increasing theft and reuse. Compromised DB creds enable unauthorized queries, leading to data exfiltration and tampering, and weaken centralized access control and rotation.

Recommendation

Enable IAM database authentication for supported engines and apply least privilege with scoped IAM policies. Prefer short-lived tokens over static DB passwords, enforce TLS, and phase out embedded credentials. Monitor authentication activity with audit logs for defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws rds modify-db-instance —db-instance-identifier <DB_INSTANCE_ID> —enable-iam-database-authentication —apply-immediately

# Enable IAM DB authentication on an RDS instance
resource "aws_db_instance" "<example_resource_name>" {
  iam_database_authentication_enabled = true  # Critical: enables IAM DB auth to pass the check
}

# CloudFormation: enable IAM DB authentication on an RDS instance
Resources:
  <example_resource_name>:
    Type: AWS::RDS::DBInstance
    Properties:
      DBInstanceIdentifier: <example_resource_id>
      EnableIAMDatabaseAuthentication: true  # Critical: enables IAM DB auth to pass the check

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = rds_instance_iam_authentication_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

RDS instance is not enrolled in RDS Extended Support RDS instance is deployed in a VPC

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires