AWS RDS Cluster
Best practices and references below are based on published guidance from the cloud service provider and may reference native capabilities the cloud service provider offers. If you are not using the native security capabilities, the same security requirement can be met using other security capabilities your organization utilizes
AWS Security Best Practices
There are number of security considerations when using AWS RDS Instances or Clusters. One key consideration is to use AWS Identity and Access Management (IAM) accounts to control access to Amazon RDS API operations, especially operations that create, modify, or delete Amazon RDSresources. Such resources include DB instances, security groups, and parameter groups. Ensure that IAM is also used to control actions that perform common administrative actions such as backing up and restoring DB instances.
- Create an individual IAM user for each person who manages Amazon RDS resources, including yourself. Don't use AWS root credentials to manage Amazon RDS resources.
- Grant each user the minimum set of permissions required to perform his or her duties.
- Use IAM groups to effectively manage permissions for multiple users.
- Rotate your IAM credentials regularly.
- Configure AWS Secrets Manager to automatically rotate the secrets for Amazon RDS. You can also retrieve the credential from AWS Secrets Manager programmatically. For more information, see Retrieving the secret value in the AWS Secrets Manager User Guide.
For more guidance on securing AWS RDS, look at oak9's security bluerprint for RDS.
Design Guidance:
Associated Roles-Feature Name | ||
Associated Roles-Role Arn |
Role Arn |
Design Guidance:
Availability Zones | ||
Deletion Protection | ||
Scaling Configuration-Auto Pause | ||
Scaling Configuration-Max Capacity | ||
Scaling Configuration-Min Capacity | ||
Scaling Configuration-Seconds Until Auto Pause |
Backup Retention Period |
Design Guidance:
Dbcluster Identifier | ||
Database Name | ||
Tags |
Tags |
Tags |
Tags |
Tags |
Engine Name | ||
Tags |
Design Guidance:
Dbcluster Parameter Group Name | ||
Engine Mode | ||
Engine Version |
Family | ||
Parameters |
Major Engine Version | ||
Option Configurations-Option Name | ||
Option Settings-Name | ||
Option Settings-Value | ||
Option Configurations-Option Version |
Design Guidance:
Dbsubnet Group Name |
VPC Subnet Ids |
EC2VPC Id |
Dbsubnet Group Description | ||
Dbsubnet Group Name | ||
Subnet Ids |
Design Guidance:
Enable Cloudwatch Logs Exports |
Debug Logging |
Enabled | |
Sns Topic Arn | |
Source Ids |
Design Guidance:
Enable Iamdatabase Authentication | ||
Master User Password | ||
Master Username |
Auth-Auth Scheme | ||
Auth-Iamauth | ||
Auth-Description | ||
Auth-Secret Arn | ||
Auth-User Name |
Design Guidance:
Kms Key Id |
Design Guidance:
Port |
Option Configurations-Port |
Design Guidance:
Preferred Backup Window | ||
Restore Type | ||
Snapshot Identifier | ||
Source Dbcluster Identifier | ||
Source Region | ||
Use Latest Restorable Time |
Preferred Maintenance Window |
Design Guidance:
Storage Encrypted |
Design Guidance:
VPC Security Group Ids |
VPC Security Group Ids |
Dbsecurity Group Ingress-Cidrip | ||
Dbsecurity Group Ingress-EC2security Group Id | ||
Dbsecurity Group Ingress-EC2security Group Name | ||
Dbsecurity Group Ingress-EC2security Group Owner Id |
Cidrip | |
Dbsecurity Group Name | |
EC2security Group Id | |
EC2security Group Name | |
EC2security Group Owner Id |
Option Configurations-VPC Security Group Memberships |
Design Guidance:
Idle Client Timeout |
Design Guidance:
Require TLS |
Design Guidance:
Connection Pool Configuration Info-Max Connections Percent | ||
Connection Pool Configuration Info-Max Idle Connections Percent | ||
Connection Pool Configuration Info-Connection Borrow Timeout | ||
Connection Pool Configuration Info-Session Pinning Filters | ||
Connection Pool Configuration Info-Init Query |
Design Guidance:
Dbproxy Name |
Dbproxy Name | ||
Target Group Name | ||
Dbinstance Identifiers | ||
Dbcluster Identifiers |
Design Guidance:
Option Configurations-Dbsecurity Group Memberships |
Last modified 6mo ago