Back to All Checks
High RDS Regional

RDS DB instances should not be deployed in public subnets with routes to internet gateways

Description

Flags Amazon RDS DB instances whose subnet group includes at least one subnet with a default route to an Internet Gateway. Public subnets give the instance a direct path to the internet even if PubliclyAccessible is false at the instance level.

Remediation

Move each affected DB instance into a subnet group that contains only private subnets.

Steps

  1. Create a new DB subnet group containing only private subnets (no IGW routes).
  2. Take a snapshot of the affected DB instance.
  3. Restore the snapshot into a new instance in the private subnet group.
  4. Cut application traffic over to the new instance and decommission the old one.
Start Your Free Security Check