Skip to main content

🛡️ AWS RDS Instance has a common master username🟢

Logic​

Similar Policies​

Description​

Open File

Description​

This policy identifies Amazon RDS Instances that are configured with a master username matching common or default values provided by database engines or the cloud platform.

When creating an Amazon RDS database, the master username should be set to a unique, non-default value. Default or commonly used administrative usernames are widely known and frequently targeted by attackers. Using a unique master username reduces the risk of unauthorized access and strengthens the overall security posture of the database.

Rationale​

Database engines and AWS documentation examples commonly reference usernames such as admin for the RDS master account. As a result, many production RDS instances are deployed using these predictable values. Malicious actors can exploit this knowledge during brute-force or credential-stuffing attacks by targeting well-known administrative usernames. Avoiding default or common master usernames significantly reduces the attack surface.

Impact​

Requires recreating the database instance with a custom master username and migrating the existing data to the new instance.

... see more

Remediation​

Open File

Remediation​

Recreate the RDS Instance with a Custom Master Username​

Amazon RDS does not support modifying the master username of an existing database instance. To remediate this finding, you must recreate the database instance with a custom master username and migrate the existing data to the new instance. Restoring the cluster from a snapshot to modify the master username is also not support.

From Command Line​

  1. Retrieve the Current Instance Configuration

    Describe the existing RDS instance to capture the configuration details required to recreate it (engine, instance class, networking, storage, and availability settings).

    aws rds describe-db-instances \
        --region {{region}} \
        --db-instance-identifier {{db-instance-id}}

  2. Review the Output and Record Required Settings

    From the command output, note the configuration values needed to create the replacement instance, including the current master username, instance class, engine, VPC security groups, subnet group, and storage configuration.

... see more

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [RDS.25] RDS database instances should use a custom administrator username1no data
💼 Cloudaware Framework → 💼 Secure Access74no data
💼 FedRAMP High Security Controls → 💼 CM-2 Baseline Configuration (L)(M)(H)3147no data
💼 FedRAMP Low Security Controls → 💼 CM-2 Baseline Configuration (L)(M)(H)45no data
💼 FedRAMP Moderate Security Controls → 💼 CM-2 Baseline Configuration (L)(M)(H)347no data
💼 NIST SP 800-53 Revision 5 → 💼 CA-9(1) Internal System Connections _ Compliance Checks54no data
💼 NIST SP 800-53 Revision 5 → 💼 CM-2 Baseline Configuration746no data
💼 PCI DSS v3.2.1 → 💼 2.1 Always change vendor-supplied defaults and remove or disable unnecessary default accounts before installing a system on the network.111no data
💼 PCI DSS v4.0.1 → 💼 2.2.2 Vendor default accounts are managed.11no data
💼 PCI DSS v4.0 → 💼 2.2.2 Vendor default accounts are managed.11no data