All checks
Medium
IAM authentication should be configured for RDS clusters
Checks that RDS DB clusters have IAM database authentication enabled, so clients can sign in with short-lived IAM tokens instead of stored passwords. The flag alone moves no one off passwords: each client also needs a database user mapped to IAM and an IAM policy granting rds-db:connect.
- service
- RDS
- severity
- Medium
- scope
- evaluated in every region
How to fix it
- Affects another check: A Neptune cluster is evaluated rather than excluded: change it in the Neptune console or with aws neptune modify-db-cluster, which also clears Neptune.7.
In the console
RDS → Databases → the DB cluster → Modify
- Database authentication
- IAM database authentication selected; password authentication stays on
With the AWS CLI
aws rds modify-db-cluster --db-cluster-identifier <db-cluster-id> --enable-iam-database-authentication --region <region>With Terraform
resource "aws_rds_cluster" "this" {
engine = var.engine
iam_database_authentication_enabled = true
}See which of your accounts this check is failing on.
Book a live scan