RDS instance is deployed in a VPC

Check ID: rds_instance_inside_vpc
Provider: AWS
Service: rds
Severity: HIGH
Categories: trust-boundaries, internet-exposed
Resource type: AwsRdsDbInstance

What this check verifies

RDS DB instances are assessed for VPC placement by the presence of a vpc_id indicating deployment within a VPC. Instances without this association are treated as outside VPC networking.

Risk

Without VPC isolation, databases may expose internet-reachable endpoints and lack granular network controls. This degrades confidentiality and availability via scanning/brute force and data exfiltration, and threatens integrity through unauthorized connections and lateral movement.

Recommendation

Deploy all RDS instances in a VPC, preferably in private subnets. Enforce least privilege with security groups, network ACLs, and restrictive routing. Use private connectivity (peering, VPN, Direct Connect), avoid public exposure, and apply defense in depth through segmentation and monitoring.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws rds modify-db-instance —db-instance-identifier <example_resource_id> —db-subnet-group-name <example_resource_name> —apply-immediately

# Terraform: ensure RDS instance is in a VPC via DB subnet group
resource "aws_db_subnet_group" "<example_resource_name>" {
  name       = "<example_resource_name>"
  subnet_ids = [
    "<example_resource_id>", # CRITICAL: Subnets in the target VPC
    "<example_resource_id>"
  ]
}

resource "aws_db_instance" "<example_resource_name>" {
  identifier          = "<example_resource_id>"
  db_subnet_group_name = aws_db_subnet_group.<example_resource_name>.name  # CRITICAL: Places instance in a VPC
}

# CloudFormation: move RDS instance into a VPC by assigning a DB subnet group
Resources:
  <example_db_subnet_group>:
    Type: AWS::RDS::DBSubnetGroup
    Properties:
      DBSubnetGroupDescription: "subnets for rds"
      SubnetIds:
        - <example_resource_id>  # CRITICAL: Subnets in the target VPC
        - <example_resource_id>  # CRITICAL: At least two AZs recommended

  <example_db_instance>:
    Type: AWS::RDS::DBInstance
    Properties:
      DBSubnetGroupName: !Ref <example_db_subnet_group>  # CRITICAL: Ensures the DB instance is deployed in a VPC

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = rds_instance_inside_vpc. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

RDS instance has IAM database authentication enabled RDS instance exports logs to CloudWatch Logs

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires