Detection of Unauthorized Public Exposure of AWS RDS Instances

Adversaries who obtain unauthorized access to AWS credentials may leverage Amazon RDS configuration changes to compromise cloud environments. By enabling the publiclyAccessible attribute on a new or existing database instance, an attacker exposes the database endpoint directly to the public internet. This misconfiguration bypasses private VPC network controls, potentially allowing an attacker to exfiltrate database contents or use the instance as a bridge for further network lateral movement. This threat is particularly relevant in environments where database security relies on network isolation rather than robust, independent authentication and encryption controls. Defenders should focus on identifying modifications performed by unexpected IAM principals or those originating from suspicious source IP addresses and user agents that bypass standard infrastructure-as-code deployment pipelines.

Attack Chain

1. Attacker gains initial access to AWS environment via stolen IAM access keys or session tokens.
2. Attacker enumerates existing RDS instances using API calls like DescribeDBInstances.
3. Attacker identifies a target database instance containing sensitive information.
4. Attacker invokes the ModifyDBInstance API to set the publiclyAccessible attribute to true.
5. Attacker simultaneously modifies security group ingress rules via AuthorizeSecurityGroupIngress to allow external connections.
6. Attacker connects to the exposed database endpoint over the public internet to dump data or deploy malicious stored procedures.
7. Attacker maintains long-term persistence by utilizing the public database endpoint as a staging or exfiltration point.

Impact

Successful exploitation leads to unauthorized data exfiltration, the loss of confidentiality for sensitive database content, and the potential compromise of internal network security postures. Victims include any organization utilizing AWS RDS without strict Service Control Policies (SCPs) preventing public accessibility.

Recommendation

• Implement AWS SCPs to explicitly deny the ability for any principal to modify the publiclyAccessible attribute to true for RDS instances.
• Deploy the provided detection logic to AWS CloudTrail logs to alert on unauthorized configuration changes in real-time.
• Utilize AWS Config rules (rds-instance-public-access-check) to automatically remediate or flag publicly accessible instances.
• Review all CloudTrail activity associated with IAM principals that perform modification actions on RDS infrastructure to identify anomalous behavior patterns.