RDS DB instance publicly accessible

Ce produit n'est pas pris en charge par le site Datadog que vous avez sélectionné. ().
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Metadata

Id: terraform-alicloud-rds-instance-publicly-accessible

Provider: Alicloud

Platform: Terraform

Severity: Medium

Category: Insecure Configurations

Learn More

Description

0.0.0.0 or 0.0.0.0/0 should not be included in the security_ips list. This rule flags alicloud_db_instance resources whose security_ips contain these public addresses. Allowing them grants public network access to the database instance and may expose it to the internet.

Compliant Code Examples

resource "alicloud_db_instance" "default" {
    engine = "MySQL"
    engine_version = "5.6"
    db_instance_class = "rds.mysql.t1.small"
    db_instance_storage = "10"
    security_ips = [
        "10.23.12.24"
        ]
    parameters = [{
        name = "innodb_large_prefix"
        value = "ON"
    },{
        name = "connect_timeout"
        value = "50"
    }]
}

resource "alicloud_db_instance" "default" {
    engine = "MySQL"
    engine_version = "5.6"
    db_instance_class = "rds.mysql.t1.small"
    db_instance_storage = "10"
    parameters = [{
        name = "innodb_large_prefix"
        value = "ON"
    },{
        name = "connect_timeout"
        value = "50"
    }]
}

Non-Compliant Code Examples

resource "alicloud_db_instance" "default" {
    engine = "MySQL"
    engine_version = "5.6"
    db_instance_class = "rds.mysql.t1.small"
    db_instance_storage = "10"
    security_ips = [
        "0.0.0.0",
        "10.23.12.24/24"
    ]
    parameters = [
        {
            name = "innodb_large_prefix"
            value = "ON"
        },{
            name = "connect_timeout"
            value = "50"
        }
    ]
}

resource "alicloud_db_instance" "default" {
    engine = "MySQL"
    engine_version = "5.6"
    db_instance_class = "rds.mysql.t1.small"
    db_instance_storage = "10"
    security_ips = [
        "0.0.0.0/0",
        "10.23.12.24/24",
    ]
    parameters = [
        {
            name = "innodb_large_prefix"
            value = "ON"
        },{
            name = "connect_timeout"
            value = "50"
        }
    ]
}