RDS instances should use a non-default port

문서 > Datadog 보안 > OOTB Rules > RDS instances should use a non-default port

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Description

Confirm Amazon RDS database instances are not using default ports. This includes default ports such as MySQL/Aurora port 3306, SQL Server port 1433, and PostgreSQL port 5432.

Rationale

Using a custom port can protect against potential brute-force and dictionary attacks.

Remediation

From the console

Follow the Modifying an Amazon RDS instance docs to verify you’re not using a default. You can modify your port by modifying that DB instance settings.

From the command line

Run create-db-snapshot with your database instance and snapshot identifiers to create a snapshot.

create-db-snapshot.sh

    aws rds create-db-snapshot \
        --db-instance-identifier database-mysql \
        --db-snapshot-identifier snapshotidentifier
    

Run modify-db-instance with a new, valid port number. A list of port numbers are available.

modify-db-instance.sh

    aws rds modify-db-instance \
        --db-instance-identifier database-identifier \
        --option-group-name test-group-name \
        --db-parameter-group-name test-sqlserver-name \
        --apply-immediately
    