Back to Checks
aws

Lightsail database public access disabled

lightsail_database_public
Service: lightsailSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:Other

Lightsail managed database is evaluated for public accessibility. When public mode is enabled, the database accepts connections from the Internet using its endpoint and port; otherwise, access is limited to authorized Lightsail resources.

Prowler logoProwlerprowler-provider-aws

Risk

Publicly reachable databases expose confidential data and credentials to the Internet, enabling:

  • Brute-force and credential stuffing
  • Data exfiltration via unauthorized queries
  • Service disruption from scanning or DoS

Compromise enables lateral movement and tampering, impacting confidentiality, integrity, and availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks lightsail_database_public

Recommendation

Disable public mode and keep the database reachable only from trusted, private networks.

  • Enforce least privilege and network segmentation
  • Use bastion hosts, tunnels, or private endpoints for admin access
  • If exposure is unavoidable, restrict by IP, rotate credentials, and monitor connections for defense in depth

Remediation

CLI

aws lightsail update-relational-database --relational-database-name <example_resource_name> --no-publicly-accessible

Terraform

# Disable public access for a Lightsail database
resource "aws_lightsail_database" "<example_resource_name>" {
  name                 = "<example_resource_name>"
  availability_zone    = "<availability_zone>"
  blueprint_id         = "<blueprint_id>"
  bundle_id            = "<bundle_id>"
  master_database_name = "<master_database_name>"
  master_username      = "<master_username>"
  master_password      = "<master_password>"

  publicly_accessible = false  # Critical: ensures the database is not publicly accessible
}

NativeIaC

# CloudFormation: disable public access on an existing Lightsail database
Resources:
  <example_resource_name>:
    Type: AWS::Lightsail::Database
    Properties:
      RelationalDatabaseName: <example_resource_name>
      PubliclyAccessible: false  # Critical: turns off public mode so the database is not publicly accessible

Other

1In the AWS Console, go to Lightsail > Databases
2Select <example_resource_name>
3Open the Networking tab
4In Public mode, toggle Off
5Wait until status returns to Available

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.lightsail.lightsail_client import lightsail_client


class lightsail_database_public(Check):
    def execute(self):
        findings = []

        for database in lightsail_client.databases.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=database)
            report.status = "FAIL"
            report.status_extended = f"Database '{database.name}' is public."

            if not database.public_access:
                report.status = "PASS"
                report.status_extended = f"Database '{database.name}' is not public."

            findings.append(report)

        return findings

References