# Ensure AWS LightSail Relational Database is not publicly accessible - Source: https://support.icompaas.com/support/solutions/articles/62000220309-ensure-aws-lightsail-relational-database-is-not-publicly-accessible - Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [Amazon Lightsail](https://support.icompaas.com/support/solutions/folders/62000167575) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ### **Description:** Lightsail is a  Virtual Private Server (VPS) that provides developers compute, storage, and networking capacity and capabilities to deploy and manage websites and web applications in the cloud. Lightsail includes everything you need to launch your project quickly – virtual machines, containers, databases, CDN, load balancers, DNS management etc. – for a low, predictable monthly price. ### **Rationale:** When public mode is enabled, anyone with your database user name and password can connect to it. Therefore it is recommended to Disable public access on the Amazon Lightsail RDS. ### **Impact:** When the public mode is disabled, only your Lightsail resources in the same Region as your database can connect to it. ### **Default Value:** There is no default value. But it can be defined at the time of creation. ### **Audit:** - **via Management Console** 1. Sign in to the AWS Management console 2. Navigate to Amazon Lightsail service at [https://lightsail.aws.amazon.com/ls](https://lightsail.aws.amazon.com/ls "https://lightsail.aws.amazon.com/ls") 3. On the **Databases** tab, choose the database on which you want to check the public mode. 4. Under **Connect** section, scroll to **Endpoint and port** to view the warning that displays the public mode status. ![](https://support.icompaas.com/assets/kb/ea1adc3a071e4316.png) 5. If public mode is **Enabled**, the RDS is publicly accessible 6. If public mode is **Disabled**, the RDS is NOT publicly accessible - **via CLI** 1. Use **get-relational-databases** command to get the information about all your databases in Amazon Lightsail. aws lightsail get-relational-databases --output table 2. In each row (database), look for the **publiclyAccessible** attribute of the database. ![](https://support.icompaas.com/assets/kb/7ac355d71ddde875.png) If the value is **True**, the Lightsail RDS is publicly accessible If the value is **False**, the Lightsail RDS is NOT publicly accessible ### **Remediation:** **Pre-Requisite:** 1. Access to Amazon Lightsail service 2. The Database that you want to work must be Active/Accessible.  **Implementation steps:** - **via Management Console** 1. Sign in to the AWS Management console 2. Navigate to Amazon Lightsail service at [https://lightsail.aws.amazon.com/ls](https://lightsail.aws.amazon.com/ls "https://lightsail.aws.amazon.com/ls") 3. On the **Databases** tab, choose the database on which you want to modify the public mode. ![](https://support.icompaas.com/assets/kb/a20a0d4421073e1f.png) 4. Under **Networking** section, Network security has the public mode. ![](https://support.icompaas.com/assets/kb/923cd9d421b9aaa3.png) 5. Turn it OFF to disable the public mode. - **via CLI** 1.  Use **update-relational-database** command to update one or more attributes of a database in Amazon Lightsail. aws lightsail update-relational-database --relational-database-name --no-publicly-accessible **Backout Plan:** - **via Management Console**  If the Lightsail RDS initially was publicly accessible, you can revert changes to turning **ON** the public mode under **Networking** section to make it publicly accessible again. ![](https://support.icompaas.com/assets/kb/c4e3d8c5aeacba71.png) - **via CLI** 1.  If the Lightsail RDS initially was publicly accessible, you can revert changes using **update-relational-database** command and make it publicly accessible again. aws lightsail update-relational-database --relational-database-name --publicly-accessible ### **Note:** - To be able to update the Lightsail RDS, the Database must be Available - While updating the RDS, the status is set to **Modifying**. Once the changes are applied successfully, the status becomes **Available.** - It could take 2-3 mins for the database to be available again after updating the status of public mode(On/Off).  ### **Reference:** [https://docs.aws.amazon.com/lightsail/](https://docs.aws.amazon.com/lightsail/ "https://docs.aws.amazon.com/lightsail/") [![](https://support.icompaas.com/assets/kb/0c62ad7d84649eec.png)lightsail — AWS CLI 1.20.64 Command Reference](https://docs.aws.amazon.com/cli/latest/reference/lightsail/index.html) [![](https://support.icompaas.com/assets/kb/5e1ae55117cd7dd4.png)get-relational-databases — AWS CLI 1.20.63 Command Reference](https://docs.aws.amazon.com/cli/latest/reference/lightsail/get-relational-databases.html)  [![](https://support.icompaas.com/assets/kb/fc403030371dec42.png)update-relational-database — AWS CLI 1.20.63 Command Reference](https://docs.aws.amazon.com/cli/latest/reference/lightsail/update-relational-database.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.