All checks
Medium
IAM authentication should be configured for RDS instances
Checks that RDS for MySQL, MariaDB and PostgreSQL DB instances, and Aurora DB instances, have IAM database authentication enabled, so clients can sign in with short-lived IAM tokens instead of stored passwords. The flag alone moves no one off passwords: each client also needs a database user mapped to IAM and an IAM policy granting rds-db:connect.
- service
- RDS
- severity
- Medium
- scope
- evaluated in every region
How to fix it
- Affects another check: An instance that belongs to an Aurora cluster is evaluated, but the setting is made on the cluster (RDS.12), and this finding may stay open on the member after the cluster is correct.
In the console
RDS → Databases → the DB instance → Modify
- Database authentication
- Password and IAM database authentication
With the AWS CLI
aws rds modify-db-instance --db-instance-identifier <db-instance-id> --enable-iam-database-authentication --region <region>With Terraform
resource "aws_db_instance" "this" {
instance_class = var.instance_class
iam_database_authentication_enabled = true
}See which of your accounts this check is failing on.
Book a live scan