RDS instance uses a non-default port for its engine

Check ID: rds_instance_non_default_port
Provider: AWS
Service: rds
Severity: LOW
Resource type: AwsRdsDbInstance

What this check verifies

RDS DB instances are evaluated for use of a port that differs from the engine’s default. Matching an engine with its default port-3306 (MySQL/MariaDB/Aurora MySQL), 5432 (PostgreSQL/Aurora), 1521 (Oracle), 1433 (SQL Server), 50000 (Db2)-indicates the instance uses the default listener.

Risk

Using a default DB port increases exposure to broad scans and eases service fingerprinting. With weak network controls, attackers can run credential brute force, target known engine exploits, or trigger DoS on the predictable port, threatening confidentiality and availability.

Recommendation

Use a non-default DB port and enforce defense in depth:

Apply least-privilege network rules
Keep databases in private subnets; avoid public exposure
Require strong authentication and audit logging

Update client connection strings and security rules when the port changes.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws rds modify-db-instance —db-instance-identifier <db-instance-id> —db-port <non-default-port>

# Terraform: set a non-default port on an RDS instance
resource "aws_db_instance" "<example_resource_name>" {
  port = <non-default-port>  # Critical: use a non-default DB engine port to pass the check
}

# CloudFormation: set a non-default port on an RDS instance
Resources:
  <example_resource_name>:
    Type: AWS::RDS::DBInstance
    Properties:
      Port: <non-default_port>  # Critical: use a non-default DB engine port to pass the check

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = rds_instance_non_default_port. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

RDS instance is not publicly exposed to the Internet RDS instance is protected by an AWS Backup plan

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires