Unrestricted MySQL Access Should Not Be Allowed
More Info:
No security group should allow unrestricted inbound access to TCP port 3306 (MySQL).Risk Level
MediumAddress
SecurityCompliance Standards
SOC2, GDPR, HITRUST, AWSWAF, NISTCSF, PCIDSS, FedRAMPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the unrestricted MySQL access issue in AWS, you can follow the below steps:
- Login to AWS console.
- Go to the RDS service.
- Select the DB instance with unrestricted MySQL access.
- Click on the “Modify” button.
- Scroll down to the “Network & Security” section.
- In the “Security Group” section, select the security group associated with the DB instance.
- Click on the “Remove” button to remove the inbound rule that allows unrestricted access to MySQL.
- Add a new inbound rule to the security group that allows access only from specific IP addresses or CIDR blocks.
- Click on the “Save Changes” button to apply the changes.
Using CLI
Using CLI
To remediate the unrestricted MySQL access issue in AWS using AWS CLI, follow the below steps:Step 1: Open the AWS CLI and run the following command to list all the security groups in your AWS account:Step 2: Identify the security group that has unrestricted MySQL access. You can filter the results using the following command:This command will list all the security groups that have unrestricted MySQL access.Step 3: Once you have identified the security group, run the following command to revoke the MySQL access:Replace This command will list the details of the security group that you have remediated.That’s it. You have successfully remediated the unrestricted MySQL access issue in AWS using AWS CLI.
<security-group-id> with the ID of the security group that you want to remediate.Step 4: Verify that the MySQL access has been revoked by running the following command:Using Python
Using Python
To remediate unrestricted MySQL access in AWS using Python, you can follow these steps:This code will loop through each RDS instance and its associated security groups. If the default security group is found, it will revoke any inbound rules that allow unrestricted MySQL access (i.e. from any IP address). The code will print a message for each instance where unrestricted MySQL access was revoked.
- Import the necessary libraries:
- Create an AWS client for the RDS service:
- Get a list of all RDS instances:
- Loop through each RDS instance and modify its security group to remove unrestricted MySQL access: