Profile Applicability:
 Level 1

Description:
 Authentication and access control are critical to securing databases by ensuring that only authorized users and applications can access the resources. Enabling strong authentication methods (such as IAM roles and policies) and controlling access with least-privilege principles helps prevent unauthorized access and protects sensitive data.

Rationale:
 Implementing strong authentication and access controls ensures that only trusted users or services can access the database. Proper access control also reduces the attack surface by granting permissions based on the principle of least privilege, minimizing the risk of unauthorized access or data exposure.

Impact:
 Failure to implement proper authentication and access control can lead to unauthorized access to sensitive database resources, potentially resulting in data breaches, data loss, or other security incidents. Enabling these controls strengthens security and ensures compliance with security best practices.

Default Value:
 By default, AWS Aurora uses IAM for authentication, but users need to explicitly configure IAM roles and policies for fine-grained access control. Without proper configuration, access may be too permissive, exposing the database to unnecessary risks.

Pre-requisites:

  • An AWS account with administrative privileges.

  • Aurora database instances deployed and running.

  • Basic knowledge of AWS IAM roles, policies, and Aurora configuration.

Test Plan:

Using AWS Console:

  1. Navigate to RDS > Databases and select your Aurora instance.

  2. In the Modify section, review the IAM roles assigned to your instance to ensure appropriate access control.

  3. Check the VPC Security Groups associated with the instance to ensure that only necessary IP ranges and subnets have access.

  4. Verify that IAM Authentication is enabled for the instance, if applicable, by navigating to the Connectivity & Security section.

Using AWS CLI:

  1. Run the following command to check IAM roles associated with the Aurora instance:
     

    aws rds describe-db-instances --query "DBInstances[].{DBInstanceIdentifier:DBInstanceIdentifier, IAMRoles:IAMRoles}"



  2. Verify VPC security group settings using:

     aws rds describe-db-instances --query "DBInstances[].{DBInstanceIdentifier:DBInstanceIdentifier, VpcSecurityGroups:VpcSecurityGroups}"



  3. Check if IAM authentication is enabled:
     

    aws rds describe-db-instances --query "DBInstances[].{DBInstanceIdentifier:DBInstanceIdentifier, IAMDatabaseAuthenticationEnabled:IAMDatabaseAuthenticationEnabled}"



Implementation Plan

Using AWS Console:

  1. Navigate to RDS > Databases, select the Aurora instance, and click Modify.

  2. In the Connectivity & Security section, enable IAM Authentication if not already configured.

  3. Under VPC Security Groups, configure access control to ensure that only trusted IP addresses or subnets are allowed access.

  4. Apply the changes and monitor the database to ensure no unintended access is granted.

Using AWS CLI:

  1. Enable IAM authentication for the Aurora instance:

     aws rds modify-db-instance --db-instance-identifier <db-instance-id> --enable-iam-database-authentication --apply-immediately



  2. Attach IAM roles to the Aurora instance:

     aws rds add-role-to-db-instance --db-instance-identifier <db-instance-id> --role-arn <iam-role-arn>



  3. Ensure that only necessary security groups are applied:

     aws rds modify-db-instance --db-instance-identifier <db-instance-id> --vpc-security-group-ids <security-group-id> --apply-immediately



Backout Plan

Using AWS Console:

  1. Navigate to RDS > Databases, select your Aurora instance, and click Modify.

  2. Disable IAM Authentication by unchecking the option in the Connectivity & Security section.

  3. Remove any IAM roles that were previously assigned to the Aurora instance.

  4. Modify VPC Security Groups to revert to previous settings.

Using AWS CLI:

  1. Disable IAM authentication for the Aurora instance:

     aws rds modify-db-instance --db-instance-identifier <db-instance-id> --no-enable-iam-database-authentication --apply-immediately



  2. Detach IAM roles from the Aurora instance:

     aws rds remove-role-from-db-instance --db-instance-identifier <db-instance-id> --role-arn <iam-role-arn>



  3. Revert VPC security groups:

     aws rds modify-db-instance --db-instance-identifier <db-instance-id> --vpc-security-group-ids <previous-security-group-id> --apply-immediately


References: