Back to Checks
aws

RDS cluster has IAM authentication enabled

rds_cluster_iam_authentication_enabled
Service: rdsSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:AwsRdsDbCluster

RDS DB clusters on supported engines (MySQL/MariaDB/PostgreSQL/Aurora) have IAM database authentication enabled for database logins, indicating token-based access managed by IAM instead of static passwords.

Prowler logoProwlerprowler-provider-aws

Risk

Without IAM DB authentication, databases depend on long-lived passwords. Stolen or reused creds can enable unauthorized connections, data exfiltration, and tampering, harming confidentiality and integrity. Lacking short-lived tokens and centralized revocation expands blast radius and weakens access control.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks rds_cluster_iam_authentication_enabled

Recommendation

Enable IAM database authentication on supported clusters and enforce least privilege. Grant only necessary rds-db:connect permissions to specific principals, prefer role-based access for workloads to obtain short-lived tokens, require TLS, and deprecate static DB passwords. Pair with auditing and segmentation for defense in depth.

Remediation

CLI

aws rds modify-db-cluster --db-cluster-identifier <DB_CLUSTER_ID> --enable-iam-database-authentication --apply-immediately

Terraform

# Enable IAM authentication on an existing RDS/Aurora cluster
resource "aws_rds_cluster" "<example_resource_name>" {
  cluster_identifier                   = "<example_resource_id>"
  iam_database_authentication_enabled = true  # Critical: enables IAM DB auth so the check passes
}

NativeIaC

# CloudFormation: Enable IAM authentication on an existing RDS/Aurora DB Cluster
Resources:
  <example_resource_name>:
    Type: AWS::RDS::DBCluster
    Properties:
      EnableIAMDatabaseAuthentication: true  # Critical: turns on IAM DB auth for the cluster

Other

1In the AWS Console, go to RDS > Databases
2Select the DB Cluster (not the instances)
3Click Modify
4In Database authentication, enable IAM database authentication
5Choose Apply immediately and click Modify cluster

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.rds.rds_client import rds_client


class rds_cluster_iam_authentication_enabled(Check):
    def execute(self):
        findings = []
        for db_cluster in rds_client.db_clusters:
            supported_engines = [
                "postgres",
                "aurora-postgresql",
                "mysql",
                "mariadb",
                "aurora-mysql",
                "aurora",
            ]
            if (
                engine in rds_client.db_clusters[db_cluster].engine
                for engine in supported_engines
            ):
                report = Check_Report_AWS(
                    metadata=self.metadata(),
                    resource=rds_client.db_clusters[db_cluster],
                )

                if rds_client.db_clusters[db_cluster].iam_auth:
                    report.status = "PASS"
                    report.status_extended = f"RDS Cluster {rds_client.db_clusters[db_cluster].id} has IAM authentication enabled."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"RDS Cluster {rds_client.db_clusters[db_cluster].id} does not have IAM authentication enabled."

                findings.append(report)

        return findings

References