# Check if Neptune Clusters have IAM authentication enabled

- Source: https://support.icompaas.com/support/solutions/articles/62000233333-check-if-neptune-clusters-have-iam-authentication-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Checks New Version](https://support.icompaas.com/support/solutions/62000112673) › [AWS New Checks](https://support.icompaas.com/support/solutions/folders/62000169206)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### Profile Applicability:

-   Level 1
    

## Description:

Amazon Neptune supports IAM database authentication, allowing you to use AWS Identity and Access Management (IAM) roles and users to authenticate to your Neptune cluster. Enabling IAM authentication eliminates the need for managing database-specific credentials and leverages AWS IAM for secure, centralized access control.

## Rationale:

-   Enhanced Security: Reduces reliance on hard-coded database credentials and allows fine-grained access control using IAM policies.
    
-   Simplified Credential Management: Leverages IAM for user authentication, reducing the need to manage database passwords.
    
-   Compliance: Helps meet security standards that require centralized identity and access management.
    

## Impact:

-   Pros:
    
    -   Improved security posture by using IAM for authentication.
        
    -   Simplified access control and centralized user management.
        
    -   Reduces the risk of credential leakage.
        
-   Cons:
    
    -   Requires configuration of IAM roles and policies for users/applications.
        
    -   Applications must use AWS SDKs to generate authentication tokens.
        

## Default Value:

-   IAM Database Authentication is disabled by default when creating a Neptune cluster.
    

## Pre-Requisites:

-   AWS IAM Permissions:
    
    -   neptune:DescribeDBClusters
        
    -   neptune:ModifyDBCluster
        
    -   iam:CreatePolicy
        
    -   iam:AttachRolePolicy
        
-   AWS CLI installed and configured with appropriate credentials.
    

## Remediation:

## Test Plan:

### Using AWS Console:

1.  Sign in to the [AWS Management Console](https://console.aws.amazon.com/).
    
2.  Navigate to Amazon Neptune → DB Clusters.
    

      ![](https://support.icompaas.com/assets/kb/4e24e6da6b05761d.png)

3.  Select the Neptune cluster to audit.
    

     ![](https://support.icompaas.com/assets/kb/1fdd0fba67f8edc9.png)

4.  Under the Connectivity & security tab, locate the IAM database authentication setting.
    
    -   Pass: If IAM authentication is enabled.
        
    -   Fail: If IAM authentication is disabled.
        

![](https://support.icompaas.com/assets/kb/2c0b3652b1d9d44b.png)

### Using AWS CLI:

Check IAM Authentication Status:

aws neptune describe-db-clusters --region <region> \\

--query "DBClusters\[\*\].{DBClusterIdentifier:DBClusterIdentifier,IAMDatabaseAuthenticationEnabled:IAMDatabaseAuthenticationEnabled}"

Example output:

\[

  {

    "DBClusterIdentifier": "my-neptune-cluster",

    "IAMDatabaseAuthenticationEnabled": false

  }

\]

-   Pass: If "IAMDatabaseAuthenticationEnabled": true
    
-   Fail: If "IAMDatabaseAuthenticationEnabled": false
    

## Implementation Steps:

### Using AWS Console:

1.  Sign in to the [AWS Management Console](https://console.aws.amazon.com/).
    
2.  Navigate to Amazon Neptune → DB Clusters.
    

      ![](https://support.icompaas.com/assets/kb/7800d1d4f4321e12.png)

           ![](https://support.icompaas.com/assets/kb/17691f6b7180900e.png)

3.  Select the Neptune cluster to modify.
    

     ![](https://support.icompaas.com/assets/kb/95dcd2e0f2825139.png)

4.  Choose Modify Cluster.
    

      ![](https://support.icompaas.com/assets/kb/468b7f3b33c6acaf.png)

5.  Under Database options, enable IAM DB authentication.
    

     ![](https://support.icompaas.com/assets/kb/68e3e6db238f34cc.png)

6.  Click Continue and apply changes.
    

 ![](https://support.icompaas.com/assets/kb/84e71bcce29fd354.png)

7.  Wait for the cluster to complete the modification process.
    

### Using AWS CLI:

Enable IAM Authentication:

aws neptune modify-db-cluster \\

--db-cluster-identifier my-neptune-cluster \\

--enable-iam-database-authentication \\

--apply-immediately \\

--region <region>

Verify Changes:

aws neptune describe-db-clusters --region <region> \\

--query "DBClusters\[\*\].{DBClusterIdentifier:DBClusterIdentifier,IAMDatabaseAuthenticationEnabled:IAMDatabaseAuthenticationEnabled}"

-   Ensure the output shows "IAMDatabaseAuthenticationEnabled": true.
    

## Backout Plan:

If enabling IAM authentication causes issues:

Disable IAM Authentication:

aws neptune modify-db-cluster \\

--db-cluster-identifier my-neptune-cluster \\

--no-enable-iam-database-authentication \\

--apply-immediately \\

--region <region>

Verify Rollback:

aws neptune describe-db-clusters --region <region> \\

--query "DBClusters\[\*\].{DBClusterIdentifier:DBClusterIdentifier,IAMDatabaseAuthenticationEnabled:IAMDatabaseAuthenticationEnabled}"

-   Ensure the output shows "IAMDatabaseAuthenticationEnabled": false.
    

## References:

1.  [Amazon Neptune IAM Database Authentication](https://docs.aws.amazon.com/neptune/latest/userguide/iam-auth.html)
    
2.  [AWS CLI Neptune Documentation](https://docs.aws.amazon.com/cli/latest/reference/neptune/index.html)[](https://docs.aws.amazon.com/neptune/latest/userguide/best-practices.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.