RDS instance is on EC2-Classic networking
- Severity
- Low
- Service
- RDS
- Check ID
- RDS_VPC_CLASSIC
What this check finds
At one point AWS did not have the concept of VPCs so all network resources had public IPs. Workloads not in VPCs cannot take advantage of certain security benefits and should be migrated. Databases should be in private subnets.
Passing looks like: RDS uses VPC (not Classic).
How to fix it
Migrate the RDS instance to a VPC. AWS Classic was retired in August 2022. Take a snapshot of the instance and restore it into a VPC subnet group.
AWS console
RDS → Databases → take snapshot → Restore to new instance in a VPC.
Compliance controls it is evidence for
A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works
| Framework | Controls |
|---|---|
| NIST SP 800-53 Rev5 (Moderate) |
|
| NIST Cybersecurity Framework 2.0 |
|
| ISO/IEC 27001:2022 Annex A |
|
Checked on every scan
KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs
More RDS checks
- HighAurora/RDS cluster storage is not encrypted at rest
- HighRDS automated backups are disabled
- HighRDS instance does not have automatic minor version upgrades enabled
- HighRDS instance has zero database connections for 7 days
- HighRDS instance storage is not encrypted at rest
- HighRDS security group allows broad CIDR ingress (broader than /16)
- HighRDS snapshot is public
- MediumAurora/RDS cluster has automated backups disabled