RDS DB Instances should prohibit public access, as determined by the PubliclyAccessible configuration

How to fix it

• Can break clients: Clients outside the VPC lose access as soon as this applies, so give them a private path first: VPN, Direct Connect, VPC peering or a host inside the VPC.
• Affects another check: This leaves RDS.46 failing if the instance's DB subnet group still includes a subnet routed to an internet gateway.

In the console

RDS → Databases → the DB instance → Modify

Public access

Not publicly accessible

With the AWS CLI

aws rds modify-db-instance --db-instance-identifier <db-instance-id> --no-publicly-accessible --region <region>

With Terraform

resource "aws_db_instance" "this" {
  instance_class      = var.instance_class
  publicly_accessible = false
}