Amazon RDS

This guide provides security configuration requirements and implementation examples for Amazon RDS in accordance with FedRAMP requirements.

Document Information

Overview

Amazon RDS security configuration involves implementing comprehensive security controls including encryption, access management, logging, and monitoring to meet FedRAMP compliance requirements. This guidance covers master user account security across all supported database engines and privileged access controls for relational database operations.

Important Disclaimer: This document provides AWS recommended practices and guidance only. It does not constitute legal, compliance, or regulatory advice. Organizations are solely responsible for determining their compliance requirements and implementing appropriate controls. AWS makes no warranties or representations regarding FedRAMP compliance or the adequacy of these recommendations for any specific use case. AWS services and features evolve rapidly. Customers should verify current service capabilities and limitations through official AWS documentation before implementation.

Command and Configuration Disclaimer: All AWS CLI commands, API calls, and configuration examples provided in this document are for illustrative purposes only. Organizations must validate all commands and configurations in non-production environments before implementation. AWS CLI commands may require specific IAM permissions, resource names, and parameter values that must be customized for each environment. Always refer to the latest AWS CLI documentation and service-specific guides for current syntax and available options.

FedRAMP Requirements

Amazon RDS must comply with the following FedRAMP requirements:

Administrative Account Model

Amazon RDS has an administrative account model.

FRR-RSC-01: Administrative Accounts

Applicable: Yes

Implementation Overview: Amazon RDS administrative access is managed through the Master database user account and AWS IAM roles. This guidance provides comprehensive security recommendations for securing administrative access to RDS instances across all supported database engines.

Master Database User Security

Master User Account Configuration:

Authentication Methods:

Database Engine-Specific Configurations

PostgreSQL Administrative Security

MySQL Administrative Security

SQL Server Administrative Security

Oracle Administrative Security

MariaDB Administrative Security

IBM DB2 Administrative Security

AWS IAM Integration

IAM Database Authentication (PostgreSQL/MySQL):

{
  "Version": "2012-10-17",		 	 	 
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "rds-db:connect",
      "Resource": "arn:aws:rds-db:region:account:dbuser:db-instance-id/db-username"
    }
  ]
}

Cross-Service Integration:

Network Security

VPC Configuration:

Connection Security:

Monitoring and Auditing

Database-Level Auditing:

AWS-Level Monitoring:

Backup and Recovery Security

Automated Backups:

Manual Snapshots:

Compliance Requirements

FedRAMP Controls Addressed:

Implementation Validation:

Implementation Checklist

☐ Configure strong master user credentials ☐ Enable IAM database authentication where supported ☐ Implement engine-specific security configurations ☐ Configure VPC and security group restrictions ☐ Enable SSL/TLS encryption in transit ☐ Set up comprehensive audit logging ☐ Configure automated encrypted backups ☐ Implement monitoring and alerting ☐ Document administrative procedures ☐ Conduct regular security reviews

This comprehensive guidance ensures that Amazon RDS administrative accounts are configured according to security best practices and FedRAMP requirements across all supported database engines.

FRR-RSC-02: Administrative Settings

Applicable: Yes

Security-Related Settings Restricted to Master User

The master user account in Amazon RDS has elevated privileges specific to each database engine. The following operations and their security implications are restricted to the master user account. Note that RDS is a managed service, so some traditional database superuser operations are not available.

1. User and Privilege Management (All Engines)

Operations:

Security Implications:

2. Database Creation and Management (All Engines)

Operations:

Security Implications:

3. PostgreSQL-Specific Master User Operations

Operations Restricted to rds_superuser Role:

Security Implications:

Note: RDS PostgreSQL master user has rds_superuser role, NOT full PostgreSQL superuser. Cannot access OS, modify pg_hba.conf, or perform certain system-level operations.

4. MySQL-Specific Master User Operations

Operations (Aurora MySQL Version 3):

Security Implications:

Note: RDS MySQL master user does NOT have SUPER privilege. Cannot perform certain system-level operations or modify some global variables.

5. SQL Server-Specific Master User Operations

Operations:

Security Implications:

Note: RDS SQL Server master user is NOT a sysadmin. Cannot access OS, modify certain server configurations, or perform xp_cmdshell operations.

6. Oracle-Specific Master User Operations

Operations:

Security Implications:

Note: RDS Oracle master user is NOT SYS/SYSTEM. Cannot access OS, modify certain initialization parameters, or perform certain DBA operations.

7. MariaDB-Specific Master User Operations

Operations:

Security Implications:

Note: RDS MariaDB master user does NOT have SUPER privilege. Cannot perform certain system-level operations, modify some global variables, or access OS-level functions.

8. IBM DB2-Specific Master User Operations

Operations:

Security Implications:

Note: RDS DB2 master user has DBADM, SYSCTRL, SYSMAINT, and SYSMON authorities but NOT SYSADM. Cannot access OS, modify certain database manager configuration parameters, or perform certain instance-level operations.

9. Parameter Group Management (All Engines)

Operations:

Security Implications:

10. Backup and Recovery Operations (All Engines)

Operations:

Security Implications:

11. Replication and High Availability (All Engines)

Operations:

Security Implications:

12. Audit and Logging Configuration (All Engines)

Operations:

Security Implications:

Best Practices for RDS Master User Account Security

Engine-Specific Limitations in RDS

Important: RDS is a managed service. The master user does NOT have full superuser/admin privileges:

PostgreSQL: - Cannot access OS or modify pg_hba.conf - Cannot install arbitrary extensions (only AWS-supported) - Cannot modify certain system parameters - Has rds_superuser role, not full superuser

MySQL: - Cannot use SUPER privilege - Cannot access mysql.user table directly for some operations - Cannot modify certain global variables - Cannot perform OS-level operations

MariaDB: - Cannot use SUPER privilege - Cannot access mysql.user table directly for some operations - Cannot modify certain global variables - Cannot perform OS-level operations - Limited access to performance_schema and information_schema tables

SQL Server: - Not a member of sysadmin role - Cannot use xp_cmdshell - Cannot access OS or file system directly - Limited server-level configuration access

Oracle: - Not SYS or SYSTEM user - Cannot access OS or modify certain init parameters - Limited DBA operations - Cannot perform certain maintenance tasks

IBM DB2: - Not SYSADM user (has DBADM, SYSCTRL, SYSMAINT, SYSMON) - Cannot access OS or modify database manager configuration - Cannot perform instance-level operations - Limited tablespace and storage management - Must use rdsadmin procedures for user and role management

FRR-RSC-03: Privileged Settings

Applicable: Yes

Within RDS you have two layers of privileged access. One layer is at the IAM layer, where you can limit what permissions a user has to operate within RDS. This section covers the priviliged settings for using the service itself and provides example IAM Policies that would allow for varying levels of access to the service. The second layer of privileged access is at the database engine layer itself which is covered in the other sections of this document.

IAM Least Privilege Policies

This section provides sample IAM policies for implementing least privilege access to Amazon RDS resources across different operational roles and responsibilities.

Policy Selection Guide

Choose the appropriate policy based on your role:

Read-Only Access Policy

Use this for: Auditors, compliance reviewers, monitoring dashboards

Grants access to:

Does NOT grant:

Testing this policy:

# Verify read access works
aws rds describe-db-instances

# Verify write access is denied (should fail)
aws rds create-db-instance --db-instance-identifier test-db

Policy JSON:

Purpose: Provides read-only access to RDS resources for monitoring and auditing purposes.

{
  "Version": "2012-10-17",		 	 	 
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "rds:Describe*",
        "rds:List*",
        "rds:Get*"
      ],
      "Resource": "*"
    }
  ]
}

Operator Access Policy

Use this for: Database operators performing routine management tasks

Grants access to:

Does NOT grant:

Testing this policy:

# Verify operator access works (requires MFA)
aws rds stop-db-instance --db-instance-identifier my-database

# Verify admin access is denied (should fail)
aws rds delete-db-instance --db-instance-identifier my-database

Policy JSON:

Purpose: Provides operational access for routine database management tasks with MFA requirement.

{
  "Version": "2012-10-17",		 	 	 
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "rds:Describe*",
        "rds:List*",
        "rds:Get*",
        "rds:StartDBInstance",
        "rds:StopDBInstance",
        "rds:RebootDBInstance",
        "rds:ModifyDBInstance"
      ],
      "Resource": "*",
      "Condition": {
        "Bool": {
          "aws:MultiFactorAuthPresent": "true"
        }
      }
    }
  ]
}

Administrator Access Policy

Use this for: Database administrators with full management access

Grants access to:

Requires:

Testing this policy:

# Verify full admin access works (requires MFA)
aws rds create-db-instance --db-instance-identifier new-database --db-instance-class db.t3.micro --engine postgres
aws rds delete-db-instance --db-instance-identifier old-database --skip-final-snapshot

Policy JSON:

Purpose: Provides full administrative access with MFA and session time restrictions.

{
  "Version": "2012-10-17",		 	 	 
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "rds:*",
      "Resource": "*",
      "Condition": {
        "Bool": {
          "aws:MultiFactorAuthPresent": "true"
        },
        "NumericLessThan": {
          "aws:MultiFactorAuthAge": "3600"
        }
      }
    }
  ]
}

Database Security Configuration

Configure Amazon RDS with comprehensive database security including encryption at rest and in transit, secure authentication, parameter groups, automated backups, and network isolation for relational database operations.

Implementation Overview: Amazon RDS security involves implementing encryption, access controls, network isolation, and comprehensive monitoring to protect database resources and meet compliance requirements.

API Reference: aws rds create-db-instance --storage-encrypted --kms-key-id

Control Mapping: SC-28 (Protection of Information at Rest)

Privileged Access Control

Amazon RDS requires implementation of privileged account security controls including least privilege access, multi-factor authentication for administrative operations, and comprehensive audit logging of privileged activities.

Implementation Overview: Amazon RDS privileged account security involves implementing strict access controls, monitoring privileged operations, and ensuring administrative activities are properly authenticated and logged.

Implementation Examples

Step 1: Implement Least Privilege Access

Configure Amazon RDS with minimal required permissions for administrative accounts:

# Create least privilege IAM policy for Amazon RDS administration
aws iam create-policy \
  --policy-name RDSAdminPolicy \
  --policy-document file://rds-admin-policy.json

# Attach policy to administrative role
aws iam attach-role-policy \
  --role-name RDSAdminRole \
  --policy-arn arn:aws:iam::account:policy/RDSAdminPolicy

Step 2: Enable Multi-Factor Authentication

Require MFA for all privileged operations and administrative access:

# MFA enforcement is configured through IAM policy conditions
# Verify MFA enforcement for privileged operations
aws iam simulate-principal-policy \
  --policy-source-arn arn:aws:iam::account:role/RDSAdminRole \
  --action-names rds:CreateDBInstance \
  --context-entries ContextKeyName=aws:MultiFactorAuthPresent,ContextKeyValues=false,ContextKeyType=boolean

Step 3: Configure Privileged Activity Monitoring

Enable comprehensive logging and monitoring of all privileged account activities:

# Enable CloudTrail for API logging
aws cloudtrail create-trail \
  --name RDSPrivilegedAccess \
  --s3-bucket-name rds-audit-logs \
  --include-global-service-events \
  --is-multi-region-trail

# Configure CloudWatch alarms for privileged operations
aws logs create-log-group \
  --log-group-name /aws/rds/privileged-access \
  --retention-in-days 365

API Reference: Configure via IAM policies and Amazon RDS administrative APIs

Control Mapping: AC-6 (Least Privilege)

FRR-RSC-04: Secure Defaults

Applicable: Yes

AWS services are designed with security in mind, providing multiple layers of security controls and encryption capabilities. However, AWS allows customers to define the security configuration of services and does not enforce a minimum security standard by default, enabling customers the flexibility to meet their specific business requirements and compliance needs.

Amazon RDS should be configured using the above AWS Security Best Practice recommendations. AWS allows customers to define the security of services, and does not enforce a minimum security standard by default.

Implementation Guidelines

Ensure Amazon RDS resources are created with security-first configurations that align with AWS security best practices and organizational compliance requirements.

Security Configuration Best Practices:

FRR-RSC-05: Configuration Comparison

Applicable: Yes

Implementation Overview: Use AWS Config rules, custom scripts, or third-party tools to compare current Amazon RDS configuration against established security baselines and compliance requirements.

AWS Config Implementation

Deploy AWS Config rules to continuously monitor Amazon RDS compliance with organizational security standards:

Configuration Monitoring Commands:

# Describe RDS instances and compare against baseline
aws rds describe-db-instances \
  --query 'DBInstances[*].{InstanceId:DBInstanceIdentifier,Encrypted:StorageEncrypted,Engine:Engine}' \
  --output table

# Export configuration for comparison
aws rds describe-db-instances --output json > current-rds-config.json

Automation Framework

FRR-RSC-06: Configuration Export

Applicable: Yes

Implementation Overview: Export Amazon RDS configuration using AWS CLI describe commands in machine-readable JSON format for backup, audit, and Infrastructure as Code purposes.

Export Procedures

Export Format: JSON via AWS CLI

Primary Export Commands:

# Export complete RDS configuration
aws rds describe-db-instances --output json > rds-instances.json
aws rds describe-db-parameter-groups --output json > rds-parameter-groups.json
aws rds describe-db-subnet-groups --output json > rds-subnet-groups.json
aws rds describe-db-security-groups --output json > rds-security-groups.json

Configuration Export Use Cases:

FRR-RSC-07: API Configuration

Applicable: Yes

Implementation Overview: Amazon RDS security configurations are manageable through AWS APIs, CLI commands, and Infrastructure as Code tools, enabling automated and repeatable security implementations.

Encryption Configuration

API Command:

# Create encrypted RDS instance
aws rds create-db-instance \
  --db-instance-identifier secure-database \
  --storage-encrypted \
  --kms-key-id alias/rds-encryption-key \
  --engine mysql \
  --db-instance-class db.t3.micro

Control Mapping: SC-28 (Protection of Information at Rest)

Backup Configuration

API Command:

# Configure automated backups with retention
aws rds modify-db-instance \
  --db-instance-identifier secure-database \
  --backup-retention-period 7 \
  --preferred-backup-window "05:00-06:00"

Control Mapping: CP-9 (Information System Backup)

Multi-AZ Configuration

API Command:

# Enable Multi-AZ deployment for high availability
aws rds modify-db-instance \
  --db-instance-identifier secure-database \
  --multi-az \
  --apply-immediately

Control Mapping: CP-6 (Alternate Processing Site)

Implementation Guidance

Role-Based Access Control:

Security Best Practices:

Additional Resources

For more information about AWS security best practices, see the following resources:

AWS Security Documentation:

Amazon RDS-Specific Resources:

Compliance and Governance: