cis-aws-database-3.7

3.7 Ensure to Implement Access Control and Authentication (Manual)

Description

Users should select whether they like to enable authentication. If they want to authenticate a password would be required, which would only allow the authorized person to access the database. Defining access control allows specific workers in a business access to the database.

Rationale

Implementing proper access control and authentication ensures that only authorized users can access the database, reducing the risk of unauthorized data access or modification.

Impact

Proper access control restricts database access to authorized users only, preventing unauthorized access and potential data breaches.

Audit Procedure

Using AWS Console

1. Sign into the AWS Management Console

   • Sign into the AWS Management Console at https://console.aws.amazon.com/ with your AWS account credentials.

2. Open the Amazon RDS Console

   • Navigate to the service using the Find Services search bar or by directly accessing the console at https://console.aws.amazon.com/rds/.

3. Select the RDS Instance

   • Choose the Amazon RDS instance you want to implement access control and authentication.
   • Click on the instance name to access its details page.
   • In the instance details page, navigate to the Configuration or Connectivity & Security section.

4. Enable IAM Database Authentication

   • Under the Connectivity or Connectivity & Security section.
   • Click the Modify or Edit option to enable IAM Database Authentication.
   • Select the option to enable IAM Database Authentication.
   • Click Continue or Save to apply the changes.

5. Create and Configure IAM Database Users

   • Click Users in the left-side menu in the Amazon RDS console.
   • Click Create database user to create a new IAM database user.
   • Provide a username and select the IAM role or IAM user that will be associated with the database user.
   • Configure the authentication type, either Password-based or IAM authentication.
   • Set the desired password or leave it blank for IAM authentication.
   • Configure the database user's privileges and permissions based on your application's requirements.
   • Click Create to create the IAM database user.

6. Configure Database User Privileges

   • Click Users in the left-side menu in the Amazon RDS console.
   • Select the database user you created in the previous step.
   • Click on Modify to modify the user's settings and permissions.
   • Configure the user's access privileges, including database access, object permissions, and privileges.
   • Click Save or Apply Changes to update the user's privileges.

7. Test Access and Authentication

   • Test the access and authentication by connecting to the RDS instance using the IAM database user's credentials or IAM role.
   • Verify that the authentication and access control mechanisms are functioning correctly.

8. Monitor and Manage IAM Database Users

   • Regularly monitor and review the IAM database users and their access privileges.
   • Adjust user privileges as needed based on changes in your application requirements.
   • Remove or disable database users when they are no longer needed.

Expected Result

IAM Database Authentication should be enabled, and database users should have properly configured access privileges following the principle of least privilege.

Remediation

Using AWS Console

Follow the audit steps above to enable IAM Database Authentication and configure proper user privileges. Review and remove any unnecessary database users or excessive privileges.

Default Value

IAM Database Authentication is disabled by default. Password-based authentication is the default authentication method.

References

1. https://aws.amazon.com/products/databases/

CIS Controls

Profile

Level 1 | Manual