Skip to main content

More Info:

All RDS databases instances provisioned within your AWS account should be using the latest generation of instance classes in order to get the best performance with lower costs.

Risk Level

Medium

Address

Reliability, Security

Compliance Standards

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Using Console

To remediate the misconfiguration of RDS instances not using the latest generation of instance classes in AWS, you can follow these steps using the AWS Management Console:
  1. Log in to the AWS Management Console: Go to https://aws.amazon.com/ and log in to your AWS account using your credentials.
  2. Navigate to RDS Service: Click on the “Services” dropdown menu at the top of the page and select “RDS” under the Database category.
  3. Select the RDS Instance: In the RDS dashboard, select the RDS instance that you want to update to the latest generation of instance classes.
  4. Modify the Instance: Click on the instance ID of the RDS instance to go to its details page. Then, click on the “Modify” button at the top of the page.
  5. Choose Instance Class: In the Modify RDS Instance page, scroll down to the “DB Instance Class” section. Click on the dropdown menu and select the latest generation of instance class that you want to use for your RDS instance.
  6. Apply Changes: Review the other configuration settings if needed, and then scroll down to the bottom of the page and click on the “Continue” button.
  7. Apply Immediately or Schedule: Choose whether you want to apply the changes immediately or schedule the modification for a later time. Select the appropriate option and click on the “Modify DB Instance” button.
  8. Monitor the Modification: The modification process will start, and you can monitor the progress on the RDS dashboard. Once the modification is complete, the RDS instance will be using the latest generation of instance classes.
By following these steps, you can remediate the misconfiguration of RDS instances not using the latest generation of instance classes in AWS.

To remediate the misconfiguration of RDS instances not using the latest generation of instance classes in AWS, you can follow these steps using the AWS CLI:
  1. List all the existing RDS instances to identify the instances that are not using the latest generation of instance classes:
  1. Identify the instances that are not using the latest generation of instance classes based on the DBInstanceClass attribute.
  2. Modify the RDS instance to use the latest generation of instance classes. You can do this by modifying the instance with the modify-db-instance command. Replace your-db-instance-identifier with the identifier of the RDS instance you want to modify and db.t3.medium with the desired latest generation instance class:
  1. Monitor the modification progress by describing the RDS instance and checking the DBInstanceClass attribute:
  1. Verify that the RDS instance is now using the latest generation of instance class.
By following these steps, you can remediate the misconfiguration of RDS instances not using the latest generation of instance classes in AWS using the AWS CLI.
To remediate the misconfiguration of RDS instances not using the latest generation of instance classes in AWS, you can use the AWS SDK for Python (Boto3) to update the instance classes. Below are the step-by-step instructions on how to remediate this issue using Python:
  1. Install Boto3: If you haven’t installed Boto3, you can do so using pip:
  2. Configure AWS Credentials: Make sure you have configured your AWS credentials with the necessary permissions to modify RDS instances. You can set up your credentials using AWS CLI or by setting environment variables.
  3. Write Python script to update RDS instance classes: Use the following Python script to update the RDS instances to use the latest generation of instance classes:
    Make sure to replace 'db.m5.large' with the latest generation instance class that you want to update the RDS instances to.
  4. Run the Python script: Save the script in a file (e.g., update_rds_instance_classes.py) and run it using Python:
  5. Verify the changes: After running the script, check the AWS Management Console or use Boto3 to confirm that the RDS instances have been updated to use the latest generation of instance classes.
By following these steps, you can remediate the misconfiguration of RDS instances not using the latest generation of instance classes in AWS using Python and Boto3.
Changing instance_class is an in‑place modification and will cause a service interruption when the change is applied (immediately if apply_immediately = true, otherwise during the next maintenance window). Test first on a snapshot or non‑production instance and pick a class compatible with your engine from the AWS RDS instance type documentation.After updating, terraform plan should show only an in-place update to aws_db_instance.THIS_DB with instance_class changing from the old value to NEW_INSTANCE_CLASS (and, if you changed it, apply_immediately).

Additional Reading: