Back to Checks
aws

GuardDuty detector has RDS Protection enabled

guardduty_rds_protection_enabled
Service: guarddutySeverity: high
OfficialBuilt-inVerified
Resource Type:AwsGuardDutyDetector

Active Amazon GuardDuty detectors are assessed for RDS Protection being enabled, allowing analysis of RDS and Aurora login activity to profile and flag anomalous access patterns.

Prowler logoProwlerprowler-provider-aws

Risk

Without RDS Protection, anomalous database logins can go unnoticed. Attackers using stolen or brute-forced credentials may access data, alter schemas, or pivot via the DB, impacting confidentiality and integrity, and potentially availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks guardduty_rds_protection_enabled

Recommendation

Enable GuardDuty RDS Protection across all accounts and Regions.

  • Enforce least privilege for DB users and rotate credentials
  • Restrict network exposure to databases
  • Integrate findings with alerting and incident response for rapid containment

Remediation

CLI

aws guardduty update-detector --detector-id <detector-id> --features Name=RDS_LOGIN_EVENTS,Status=ENABLED

Terraform

resource "aws_guardduty_detector" "<example_resource_name>" {
  enable = true
  features {
    name   = "RDS_LOGIN_EVENTS"  # critical: GuardDuty RDS Protection feature
    status = "ENABLED"            # critical: enable the feature
  }
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::GuardDuty::Detector
    Properties:
      Enable: true
      Features:
        - Name: RDS_LOGIN_EVENTS  # critical: selects GuardDuty RDS Protection feature
          Status: ENABLED         # critical: turns RDS Protection on

Other

1In the AWS Console, open Amazon GuardDuty
2Go to Settings (or Protection plans/Features)
3Find RDS Protection (RDS login events) and click Enable
4Save changes
5If using Organizations, perform this in the delegated GuardDuty administrator account

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.guardduty.guardduty_client import guardduty_client


class guardduty_rds_protection_enabled(Check):
    def execute(self):
        findings = []
        for detector in guardduty_client.detectors:
            if detector.status:
                report = Check_Report_AWS(metadata=self.metadata(), resource=detector)
                report.status = "FAIL"
                report.status_extended = (
                    "GuardDuty detector does not have RDS Protection enabled."
                )
                if detector.rds_protection:
                    report.status = "PASS"
                    report.status_extended = (
                        "GuardDuty detector has RDS Protection enabled."
                    )
                findings.append(report)
        return findings

References