RDS instance has a public IP address

Severity: Low
Service: RDS
Check ID: RDS_PUBLIC_IP

What this check finds

Check whether this RDS instance is publicly accessible. Best practice is to put RDS instances in private subnets and not give them public IPs.

Passing looks like: RDS not publicly accessible.

How to fix it

Disable public accessibility on the RDS instance and move it to private subnets.

AWS CLI

aws rds modify-db-instance --db-instance-identifier INSTANCE_ID --no-publicly-accessible --apply-immediately

Names in capitals are placeholders for your own resource. Review a command before you run it.

AWS console

RDS → Databases → select instance → Modify → Connectivity → Public access → No.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to RDS instance has a public IP address
Framework	Controls
CIS AWS Foundations Benchmark v5.0.0	2.2.3 Ensure that RDS instances are not publicly accessible
PCI-DSS v4.0.1	1.3 Network access to and from the cardholder data environment is restricted
NIST SP 800-53 Rev5 (Moderate)	SC-7 Boundary Protection
NIST Cybersecurity Framework 2.0	PR.IR-01 Networks and environments are protected from unauthorized logical access and usage
ISO/IEC 27001:2022 Annex A	A.8.20 Networks security

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More RDS checks

All RDS checks