All checks
Low
RDS instances should not use a database engine default port
Flags RDS DB instances listening on their engine's default port, the one untargeted scans try first. This is one thin layer, never a substitute for keeping the instance out of public subnets and off open security groups. RDS Custom cannot change its port in place: such an instance clears only when replaced by one on a non-default port.
- service
- RDS
- severity
- Low
- scope
- evaluated in every region
How to fix it
- Interrupts service: Changing the port restarts the database at once, whether or not you apply the change immediately.
- Can break clients: Connections fail until every connection string and secret names the new port and the instance's security group has an ingress rule for it.
In the console
RDS → Databases → the DB instance → Modify → Connectivity
- Database port
- 1150 to 65535, not the engine default; on SQL Server not 1234, 1434, 3260, 3343, 3389, 47001 or 49152 to 49156
With the AWS CLI
aws rds modify-db-instance --db-instance-identifier <db-instance-id> --db-port-number <port> --region <region>With Terraform
resource "aws_db_instance" "this" {
instance_class = var.instance_class
port = var.db_port
}See which of your accounts this check is failing on.
Book a live scan