More Info:
Your AWS Relational Database Service (RDS) database snapshots should not be publicly accessible. This is to avoid exposing your private data.Risk Level
CriticalAddress
SecurityCompliance Standards
HIPAA, PCIDSS, NIST, AWSWAF, GDPRTriage and Remediation
Remediation
Using Console
Using Console
To remediate the issue of RDS Database Snapshots being public in AWS, follow these steps using the AWS Management Console:
- Sign in to the AWS Management Console: Go to https://aws.amazon.com/ and sign in to your AWS account.
- Navigate to the RDS Service: Click on the “Services” dropdown menu at the top of the page, then select “RDS” under the Database category.
- Select the RDS Instance: In the RDS dashboard, locate and click on the RDS instance for which you want to secure the snapshots.
- Access the Snapshots: In the RDS instance details page, find the “Snapshots” section in the left-hand menu and click on it.
- Identify Public Snapshots: Look through the list of snapshots to identify any that are marked as public.
-
Modify Snapshot Permissions:
- Click on the checkbox next to the public snapshot(s) that you want to secure.
- Click on the “Modify Snapshot Permissions” button in the top menu.
- In the “Modify Snapshot Permissions” window, uncheck the option that allows public access.
- Click on the “Save Changes” button to apply the new permissions.
-
Verify Changes:
- Review the list of snapshots again to ensure that the public snapshots are no longer accessible to the public.
- Repeat if Necessary: If you have multiple RDS instances with public snapshots, repeat the above steps for each instance to secure all the snapshots.
Using CLI
Using CLI
To remediate the issue of RDS Database Snapshots being public in AWS using AWS CLI, follow these steps:By following these steps, you can remediate the misconfiguration of RDS Database Snapshots being public in AWS RDS using AWS CLI.
- List all the RDS database snapshots that are currently public:
- Modify the DB snapshot attribute to make it private:
- Verify that the DB snapshot attribute has been updated successfully:
Using Python
Using Python
To remediate the misconfiguration of having RDS database snapshots public in AWS using Python, you can follow these steps:
-
Identify the Public Snapshots:
- Use the AWS SDK for Python (Boto3) to list all the RDS database snapshots.
- Filter out the snapshots that are marked as public.
-
Update Snapshot Permissions:
- For each public snapshot identified, modify the snapshot attribute to make it private.
- Use the
modify_db_snapshot_attributemethod from the Boto3 RDS client to update the snapshot attribute.
-
Sample Python Script:
Here is a sample Python script that demonstrates how to identify and update public RDS database snapshots to private:
-
Run the Script:
- Save the script in a file (e.g.,
remediate_public_snapshots.py) and run it using Python. - Make sure you have the necessary IAM permissions to modify RDS snapshot attributes.
- Save the script in a file (e.g.,