Back to Checks
aws

Neptune cluster is not using public subnets

neptune_cluster_uses_public_subnet
Service: neptuneSeverity: medium
OfficialBuilt-inVerified
Categories:internet-exposedtrust-boundaries
Resource Type:AwsRdsDbCluster

Neptune cluster is associated with one or more public subnets.

Prowler logoProwlerprowler-provider-aws

Risk

A Neptune cluster in a public subnet increases exposure across the CIA triad:

  • Confidentiality: Direct access enables credential attacks and data exfiltration
  • Integrity: Attackers may modify or inject graph data
  • Availability: Public reachability allows DDoS or remote exploitation, causing downtime

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks neptune_cluster_uses_public_subnet

Recommendation

Place Neptune clusters in private subnets and remove public routability to reduce attack surface.

  • Apply least privilege and network segmentation
  • Restrict inbound access with scoped network controls and minimal trusted paths
  • Enforce logging, monitoring, and private connectivity for administrative and application access

Remediation

Terraform

resource "aws_neptune_subnet_group" "neptune" {
  name       = "neptune-private-subnets"
  subnet_ids = ["<PRIVATE_SUBNET_ID_1>", "<PRIVATE_SUBNET_ID_2>"]  # Use only private subnet IDs to prevent public access
}

resource "aws_neptune_cluster" "example_cluster" {
  neptune_subnet_group_name = aws_neptune_subnet_group.neptune.name  # Associate cluster with private subnet group
}

NativeIaC

Resources:
  NeptuneSubnetGroup:
    Type: AWS::Neptune::DBSubnetGroup
    Properties:
      DBSubnetGroupDescription: "Private subnets for Neptune"
      SubnetIds:  # Use only private subnet IDs to prevent public access
        - <PRIVATE_SUBNET_ID_1>
        - <PRIVATE_SUBNET_ID_2>

  NeptuneDBCluster:
    Type: AWS::Neptune::DBCluster
    Properties:
      DBSubnetGroupName: !Ref NeptuneSubnetGroup  # Associate cluster with private subnet group

Other

1Open the AWS Console and go to Amazon Neptune > Subnet groups
2Click Create DB Subnet Group
3Enter a name and description, select the VPC, and add only private subnet IDs (at least two)
4Click Create
5Go to Amazon Neptune > DB clusters > Select the cluster > Actions > Modify
6Set DB subnet group to the newly created subnet group and save (Apply immediately if required)
7Verify the cluster subnet group now lists only private subnets

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.neptune.neptune_client import neptune_client
from prowler.providers.aws.services.vpc.vpc_client import vpc_client


class neptune_cluster_uses_public_subnet(Check):
    def execute(self):
        findings = []
        for cluster in neptune_client.clusters.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=cluster)
            report.status = "PASS"
            report.status_extended = (
                f"Cluster {cluster.id} is not using public subnets."
            )

            public_subnets = []
            for subnet in cluster.subnets:
                if vpc_client.vpc_subnets[subnet].public:
                    public_subnets.append(vpc_client.vpc_subnets[subnet].id)

            if len(public_subnets) > 0:
                report.status = "FAIL"
                report.status_extended = f"Cluster {cluster.id} is using {', '.join(public_subnets)} public subnets."
            findings.append(report)

        return findings

References