RDS instance is not publicly exposed to the Internet

Check ID: rds_instance_no_public_access
Provider: AWS
Service: rds
Severity: CRITICAL
Categories: internet-exposed
Resource type: AwsRdsDbInstance

What this check verifies

RDS DB instances are assessed for internet exposure using the PubliclyAccessible setting, security group ingress to the DB port from any address, and whether subnets are public. Instances that combine an internet-facing endpoint, open ingress, and public subnets are identified.

Risk

An internet-reachable database invites:

Brute-force and vulnerability probing, risking availability and integrity
Unauthorized queries and dumps leading to confidentiality loss

Compromise can enable lateral movement and persistence within the VPC.

Recommendation

Keep databases private by applying least privilege at the network layer:

Set PubliclyAccessible to false
Place instances in private subnets
Deny 0.0.0.0/0 and ::/0 on the DB port
Expose access via private endpoints, VPN, or an application tier/DB proxy

Adopt defense in depth with monitoring and strong auth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws rds modify-db-instance —db-instance-identifier <db_instance_id> —no-publicly-accessible —apply-immediately

# Ensure the RDS instance is not publicly accessible
resource "aws_db_instance" "<example_resource_name>" {
  publicly_accessible = false  # CRITICAL: disables public access (no public endpoint)
}

# CloudFormation: make the RDS instance private
Resources:
  <example_resource_name>:
    Type: AWS::RDS::DBInstance
    Properties:
      DBInstanceIdentifier: <example_resource_id>
      PubliclyAccessible: false  # CRITICAL: disables public access so the instance is not Internet-facing

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = rds_instance_no_public_access. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

RDS instance has Multi-AZ enabled RDS instance uses a non-default port for its engine

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires