Back to Checks
aws

RDS cluster uses a non-default port for its database engine

rds_cluster_non_default_port
Service: rdsSeverity: low
OfficialBuilt-inVerified
Resource Type:AwsRdsDbCluster

RDS DB clusters are assessed for use of a non-default database port.

Evaluation focuses on whether the cluster listens on the engine's well-known default port (e.g., 3306, 5432, 1433, 1521, 50000) or on a custom port.

Prowler logoProwlerprowler-provider-aws

Risk

Using a default DB port eases discovery via mass scans and banner-grabbing, enabling:

  • Engine-specific exploit attempts
  • Brute-force/credential-stuffing of logins
  • Targeted DDoS on the service

Impacts: confidentiality (unauthorized reads), integrity (data changes), availability (service disruption).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks rds_cluster_non_default_port

Recommendation

Use a non-default port and enforce least-privilege network access:

  • Allow only approved sources
  • Keep databases in private subnets
  • Require TLS and strong, centralized auth
  • Monitor failed connections

Update application connection strings to the new port as part of defense-in-depth.

Remediation

CLI

aws rds modify-db-cluster --db-cluster-identifier <db-cluster-id> --port <non-default-port> --apply-immediately

Terraform

# Terraform: Set a non-default port on an RDS/Aurora DB cluster
resource "aws_rds_cluster" "<example_resource_name>" {
  engine          = "<engine>"
  master_username = "<username>"
  master_password = "<password>"
  port            = <non-default-port> # Critical: use a non-default engine port to pass the check
}

NativeIaC

# CloudFormation: Set a non-default port on an RDS/Aurora DB cluster
Resources:
  <example_resource_name>:
    Type: AWS::RDS::DBCluster
    Properties:
      Engine: <engine>
      MasterUsername: <username>
      MasterUserPassword: <password>
      Port: <non-default-port>  # Critical: change to a non-default engine port to pass the check

Other

1In the AWS Console, go to RDS > Databases
2Select your DB cluster (not an individual instance)
3Click Modify
4Set Database port to a non-default value for the engine
5Check Apply immediately
6Click Continue, then Modify cluster

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.rds.rds_client import rds_client


class rds_cluster_non_default_port(Check):
    def execute(self):
        findings = []
        default_ports = {
            3306: ["mysql", "mariadb", "aurora-mysql"],
            5432: ["postgres", "aurora-postgresql"],
            1521: ["oracle"],
            1433: ["sqlserver"],
            50000: ["db2"],
        }
        for db_cluster in rds_client.db_clusters.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=db_cluster)
            report.status = "PASS"
            report.status_extended = (
                f"RDS Cluster {db_cluster.id} is not using the default port "
                f"{db_cluster.port} for {db_cluster.engine}."
            )
            if db_cluster.port in default_ports:
                default_engines = default_ports[db_cluster.port]
                for default_engine in default_engines:
                    if default_engine in db_cluster.engine.lower():
                        report.status = "FAIL"
                        report.status_extended = (
                            f"RDS Cluster {db_cluster.id} is using the default port "
                            f"{db_cluster.port} for {db_cluster.engine}."
                        )

            findings.append(report)

        return findings

References