Amazon_RDS_9

Ensure RDS is not using the default port

Description

Running your database instances on default ports represent a potential security concern. Moving RDS instances ports (the ports on which the database accepts connections) to non-default ports will add an extra layer of security, protecting your publicly accessible AWS RDS databases

Remediation

1. Login to the AWS Management Console.

2. Navigate to EC2 dashboard.

3. In the navigation panel, under RDS Dashboard, click Instances.

4. Select the RDS database instance that you want to reconfigure.

5. Click Instance Actions button from the dashboard top menu and select Take Snapshot to create a database snapshot.

6. On the Take DB Snapshot page, in the Snapshot Name box, enter a unique name for the database backup then click Take Snapshot to send the request.

7. Go back to the Instances page and select again the RDS instance that you want to modify.

8. Click Instance Actions button from the dashboard top menu and select Modify.

9. On the Modify DB Instance: <instance identifier> page, perform the following actions:

  1. In the Database Port box, replace the database default port number with your custom port number. The valid port numbers that can be used are 1150 to 65535 for MySQL/MariaDB/Aurora/PostgreSQL/Oracle and 1150 to 65535 except for 1434, 3389, 47001, 49152, and 49152-49156 for SQL Server.
  2. At the bottom of the page select Apply Immediately checkbox to apply the endpoint port number change immediately.

(!) IMPORTANT: when you modify the database instance port number, an immediate outage will occur if a custom parameter group is used. If the selected database instance is used in production consider leaving Apply Immediately option disabled before applying the changes in order to avoid any downtime. If Apply Immediately is not selected, the database port number change will be processed during the next maintenance window.

10. Click the Continue button to continue the process.

11. Review the database port changes and click Modify DB Instance to apply the changes.

12. Once the database configuration is successfully updated, you can change the endpoint port number at your application level to match the non-default port set at step no. 9.

Service

RDS

Severity

Low

Compliance

Mapping

We are now live on AWS Marketplace.
The integrated view of your cloud infrastructure is now easier than ever!