# 2.2.3 Ensure that RDS instances are not publicly accessible

- Source: https://support.icompaas.com/support/solutions/articles/62000233082-2-2-3-ensure-that-rds-instances-are-not-publicly-accessible
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS CIS V.4 Level 1 Benchmarks](https://support.icompaas.com/support/solutions/62000112671) › [CIS Control 2](https://support.icompaas.com/support/solutions/folders/62000169193)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### Profile Applicability:

Level 1

## Description:

Amazon RDS should not be publicly accessible to prevent unauthorized access to sensitive data. A publicly accessible RDS instance allows any internet-based attacker to attempt to connect to the database.

## Rationale:

-   Restricts exposure of the database to the public internet.
    
-   Minimizes attack vectors like brute-force login attempts and SQL injection.
    
-   Ensures compliance with security best practices (SOC 2, PCI-DSS, GDPR, HIPAA).
    
-   Prevents data breaches by limiting access to only internal applications and users.
    

## Impact:

-   If RDS is not publicly accessible, only resources within the same VPC can connect.
    
-   Access must be explicitly allowed via VPC security groups and IAM roles.
    
-   Certain AWS services may require adjustments, such as Lambda, EC2, or on-prem applications.
    

## Default Value:

By default, AWS RDS does not enable public access unless explicitly configured.

Pre-Requisites:

1.  IAM permissions to modify RDS instances:
    
    -   rds:DescribeDBInstances, rds:ModifyDBInstance, ec2:DescribeRouteTables
        
2.  AWS CLI installed (for automation)
    
3.  List of all RDS instances in your AWS account
    

## Remediation:

### Test Plan:

## Using AWS Console

Step 1: Check if an RDS Instance is Publicly Accessible

1.  Log in to the AWS Management Console
    
2.  Navigate to RDS Dashboard → [Amazon RDS Console](https://console.aws.amazon.com/rds/)
    
3.  Click Databases
    

           ![](https://support.icompaas.com/assets/kb/4c174011e137bf5e.png)

4.  Select an RDS instance.           ![](https://support.icompaas.com/assets/kb/39e4b8c069ed6cef.png)           
    
5.  Click Connectivity & security.
    

            ![](https://support.icompaas.com/assets/kb/151825930f7b9c8d.png)

6.  Under Security group rules, check if Publicly Accessible is set to Yes.
    

                     ![](https://support.icompaas.com/assets/kb/b9e12e00c0ae5dba.png)

Step 2: Check If RDS is in a Public Subnet

1.  Navigate to Amazon VPC Console → [Amazon VPC Console](https://console.aws.amazon.com/vpc/)
    
2.  Click Subnets
    

                    ![](https://support.icompaas.com/assets/kb/3ddfa4c082e5fbf8.png)

3.  Select the subnet associated with the RDS instance
    

             ![](https://support.icompaas.com/assets/kb/e7c3973d7b1f4104.png)

4.  Click Route Table → Check if there is a route with Destination: 0.0.0.0/0   ![](https://support.icompaas.com/assets/kb/60d422b08dbf365a.png)   
    
5.  If Gateway ID is an Internet Gateway (igw-xxxxxx), the subnet is public         ![](https://support.icompaas.com/assets/kb/dc3310757b5bdc85.png)         
    

## Using AWS CLI

Step 1: List All RDS Instances

aws rds describe-db-instances --query 'DBInstances\[\*\].DBInstanceIdentifier'

Find the RDS instance(s) that need verification.

Step 2: Check If an RDS Instance is Publicly Accessible

aws rds describe-db-instances --db-instance-identifier <db-name> --query 'DBInstances\[\*\].PubliclyAccessible'

Expected Output (If private):

\[

    false

\]

Step 3: Verify the Subnet Route Table

aws rds describe-db-instances --db-instance-identifier <db-name> --query 'DBInstances\[\*\].DBSubnetGroup.Subnets\[\*\].SubnetIdentifier'

Extract the subnet ID(s) of the RDS instance.

aws ec2 describe-route-tables --filters "Name=association.subnet-id,Values=<subnet-id>" --query 'RouteTables\[\*\].Routes'

## Implementation Steps:

## Using AWS Console

Step 1: Modify RDS Public Accessibility

1.  Log in to the AWS Console
    
2.  Navigate to Amazon RDS Console
    
3.  Click Databases → Select the RDS instance
    

            ![](https://support.icompaas.com/assets/kb/2c2b386bdd873c46.png)

4.  Click Modify
    

           ![](https://support.icompaas.com/assets/kb/beb91724c7bcc4e6.png)

5.  Under Connectivity, locate Publicly Accessible → Select No          ![](https://support.icompaas.com/assets/kb/a8ce3b795ec5ee69.png)          
    
6.  Click Continue ![](https://support.icompaas.com/assets/kb/05386f5c579e63ef.png) 
    
7.  Choose one:
    
    -   Apply immediately → Changes take effect immediately (may cause downtime).
        
    -   Apply during next maintenance window (Recommended for production).
        

            ![](https://support.icompaas.com/assets/kb/f8ea3d7de3b02dcf.png)

8.  Click Modify DB Instance
    

                   ![](https://support.icompaas.com/assets/kb/5eec81a48a55cb6a.png)

-   The instance is now private.

Step 2: Move RDS to a Private Subnet

1.  Navigate to Amazon VPC Console
    
2.  Click Subnets
    

                   ![](https://support.icompaas.com/assets/kb/619b485d695a255e.png)

3.  Find the subnet ID associated with RDS
    

         ![](https://support.icompaas.com/assets/kb/2e4867582bfd8755.png)

4.  Click Route Table             ![](https://support.icompaas.com/assets/kb/daf88e7d4a2826f3.png)             
    
5.  Click Edit routes      ![](https://support.icompaas.com/assets/kb/ecb6f60dc29efc5e.png)      
    
6.  Remove any 0.0.0.0/0 routes pointing to an Internet Gateway (igw-xxxxxx)       ![](https://support.icompaas.com/assets/kb/c1846e0852c82413.png)       
    
7.  Save changes
    

![](https://support.icompaas.com/assets/kb/10cc897e50da0c07.png)

-    The instance is no longer accessible from the internet.

## Using AWS CLI

Step 1: Disable Publicly Accessible Setting

aws rds modify-db-instance --db-instance-identifier <db-name> --no-publicly-accessible --apply-immediately

-   This makes the instance private immediately.

Step 2: Remove Public Route from the Subnet

aws ec2 delete-route --route-table-id <route-table-id> --destination-cidr-block 0.0.0.0/0

-   This ensures the subnet is private.

##   
Backout Plan:  
If changes cause disruptions: Re-enable public access if necessary: 

aws rds modify-db-instance --db-instance-identifier <db-name> --publicly-accessible --apply-immediately

1.  Add a bastion host for secure access.
    
2.  Restore networking configurations via AWS Console.
    

## References:

-   [Amazon RDS Security Best Practice](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.html)
    
-   [Working with RDS in a VPC](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_VPC.WorkingWithRDSInstanceinaVPC.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.