Back to Checks
aws

RDS cluster master username is not admin or postgres

rds_cluster_default_admin
Service: rdsSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:AwsRdsDbCluster

RDS DB clusters are evaluated for use of a custom administrator username, flagging clusters that use defaults such as admin or postgres.

Prowler logoProwlerprowler-provider-aws

Risk

Using a well-known admin username simplifies credential stuffing and brute-force attempts. Attackers can focus on password guessing, increasing chances of compromise. A successful login enables data theft (confidentiality), unauthorized changes (integrity), and destructive operations or outages (availability).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks rds_cluster_default_admin

Recommendation

Create databases with a unique, non-default admin username that doesn't reveal environment or org. Apply least privilege by using separate, non-admin accounts for applications. Prefer IAM database authentication and manage secrets centrally with rotation. Restrict admin access and monitor login attempts.

Remediation

Terraform

# Create an RDS DB cluster with a custom admin username
resource "aws_rds_cluster" "<example_resource_name>" {
  cluster_identifier = "<example_resource_id>"
  engine             = "aurora-mysql"
  master_username    = "<custom_admin_username>" # CRITICAL: non-default username (not admin/postgres)
  master_password    = "<example_password>"
}

NativeIaC

# Create an RDS DB cluster with a custom admin username
Resources:
  <example_resource_name>:
    Type: AWS::RDS::DBCluster
    Properties:
      Engine: aurora-mysql
      MasterUsername: <custom_admin_username>  # CRITICAL: use a non-default username (not "admin" or "postgres")
      MasterUserPassword: <example_password>

Other

1In the AWS console, go to RDS > Databases > Create database
2Choose Amazon Aurora and the same engine family as your current cluster
3Under Settings, set Master username to a custom value that is not "admin" or "postgres" (CRITICAL)
4Create the new cluster, migrate your workload to it, update application connections, then delete the old cluster

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.rds.rds_client import rds_client


class rds_cluster_default_admin(Check):
    def execute(self):
        findings = []
        for db_cluster in rds_client.db_clusters:
            report = Check_Report_AWS(
                metadata=self.metadata(),
                resource=rds_client.db_clusters[db_cluster],
            )
            report.status = "FAIL"
            report.status_extended = f"RDS Cluster {rds_client.db_clusters[db_cluster].id} is using the default master username."
            if rds_client.db_clusters[db_cluster].username not in [
                "admin",
                "postgres",
            ]:
                report.status = "PASS"
                report.status_extended = f"RDS Cluster {rds_client.db_clusters[db_cluster].id} is not using the default master username."

            findings.append(report)

        return findings

References