All checks
High
RDS DB instances should not be deployed in public subnets with routes to internet gateways
Flags RDS DB instances whose DB subnet group includes any subnet with an active route to an internet gateway, whatever its destination; a subnet with no route table of its own is judged by its VPC's main one. A private subnet keeps the database off the internet whatever its other settings say, and turning off public access (RDS.2) does not clear this.
- service
- RDS
- severity
- High
- scope
- evaluated in every region
How to fix it
In the console
RDS → Databases → the DB instance → Modify (build the private group first at RDS → Subnet groups)
With the AWS CLI
aws rds modify-db-instance --db-instance-identifier <db-instance-id> --db-subnet-group-name <private-db-subnet-group> --region <region>With Terraform
resource "aws_db_instance" "this" {
db_subnet_group_name = aws_db_subnet_group.private.name
instance_class = var.instance_class
}See which of your accounts this check is failing on.
Book a demo