RDS instances should use a non-default port

Docs > Plateforme de sécurité Datadog > OOTB Rules > RDS instances should use a non-default port

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Description

Confirm Amazon RDS database instances are not using default ports. This includes default ports such as MySQL/Aurora port 3306, SQL Server port 1433, and PostgreSQL port 5432.

Rationale

Using a custom port can protect against potential brute-force and dictionary attacks.

Remediation

From the console

Follow the Modifying an Amazon RDS instance docs to verify you’re not using a default. You can modify your port by modifying that DB instance settings.

From the command line

Run create-db-snapshot with your database instance and snapshot identifiers to create a snapshot.

create-db-snapshot.sh

    aws rds create-db-snapshot \
        --db-instance-identifier database-mysql \
        --db-snapshot-identifier snapshotidentifier
    

Run modify-db-instance with a new, valid port number. A list of port numbers are available.

modify-db-instance.sh

    aws rds modify-db-instance \
        --db-instance-identifier database-identifier \
        --option-group-name test-group-name \
        --db-parameter-group-name test-sqlserver-name \
        --apply-immediately
    