Check provider logo

GuardDuty detector has RDS Protection enabled

guardduty_rds_protection_enabled

Severityhigh
Serviceguardduty
by Prowler

Active Amazon GuardDuty detectors are assessed for RDS Protection being enabled, allowing analysis of RDS and Aurora login activity to profile and flag anomalous access patterns.

Risk

Without RDS Protection, anomalous database logins can go unnoticed. Attackers using stolen or brute-forced credentials may access data, alter schemas, or pivot via the DB, impacting confidentiality and integrity, and potentially availability.

Run this check with Prowler CLI

prowler aws --checks guardduty_rds_protection_enabled

Run in Prowler Cloud

Recommendation

Enable GuardDuty RDS Protection across all accounts and Regions.

  • Enforce least privilege for DB users and rotate credentials
  • Restrict network exposure to databases
  • Integrate findings with alerting and incident response for rapid containment

Remediation

CLI

aws guardduty update-detector --detector-id <detector-id> --features Name=RDS_LOGIN_EVENTS,Status=ENABLED

Native IaC
Terraform
Other
  1. In the AWS Console, open Amazon GuardDuty
  2. Go to Settings (or Protection plans/Features)
  3. Find RDS Protection (RDS login events) and click Enable
  4. Save changes
  5. If using Organizations, perform this in the delegated GuardDuty administrator account

Source Code

Resource Type

AwsGuardDutyDetector

References