Back to Checks
aws

RDS instance does not use the default master username (admin or postgres)

rds_instance_default_admin
Service: rdsSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:AwsRdsDbInstance

RDS DB instances are evaluated for use of a custom administrator username. The finding identifies instances or clusters where the admin user matches common defaults like admin or postgres (checked at the instance or cluster level).

Prowler logoProwlerprowler-provider-aws

Risk

Using a predictable admin name enables password spraying, credential stuffing, and username enumeration. A successful login can expose data (confidentiality), allow tampering (integrity), and disrupt service (availability). Defaults also attract automated scans targeting known usernames.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks rds_instance_default_admin

Recommendation

Adopt a unique, non-default admin username for each database and avoid enabling default accounts.

  • Enforce least privilege with separate admin and app users
  • Use strong, rotated secrets in a manager and prefer IAM DB authentication
  • Restrict network exposure and audit authentication activity

Remediation

Terraform

# Terraform: Create an RDS instance with a non-default master username
resource "aws_db_instance" "<example_resource_name>" {
  engine            = "mysql"
  instance_class    = "db.t3.micro"
  allocated_storage = 20
  username          = "<non_default_username>" # Critical: custom admin username (not "admin" or "postgres")
  password          = "<example_password>"
}

NativeIaC

# CloudFormation: Create an RDS instance with a non-default master username
Resources:
  <example_resource_name>:
    Type: AWS::RDS::DBInstance
    Properties:
      Engine: mysql
      DBInstanceClass: db.t3.micro
      AllocatedStorage: 20
      MasterUsername: <non_default_username>  # Critical: use a custom admin username (not "admin" or "postgres")
      MasterUserPassword: <example_password>

Other

1In the AWS Console, go to RDS > Databases and click Create database
2Choose your engine and select Standard create
3In Settings, set Master username to a value that is not "admin" or "postgres"
4Complete creation and note the new endpoint
5Migrate data from the old instance to the new one (e.g., dump/restore or replication)
6Update applications to use the new endpoint, then delete the old instance
7If the instance is part of an Aurora cluster, create a new cluster with a non-default master username and migrate to it

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.rds.rds_client import rds_client


class rds_instance_default_admin(Check):
    def execute(self):
        findings = []
        for db_instance in rds_client.db_instances.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=db_instance)
            # Check if is member of a cluster
            if db_instance.cluster_id:
                if (
                    db_instance.cluster_arn in rds_client.db_clusters
                    and rds_client.db_clusters[db_instance.cluster_arn].username
                    not in ["admin", "postgres"]
                ):
                    report.status = "PASS"
                    report.status_extended = f"RDS Instance {db_instance.id} is not using the default master username at cluster {db_instance.cluster_id} level."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"RDS Instance {db_instance.id} is using the default master username at cluster {db_instance.cluster_id} level."
            else:
                if db_instance.username not in ["admin", "postgres"]:
                    report.status = "PASS"
                    report.status_extended = f"RDS Instance {db_instance.id} is not using the default master username."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"RDS Instance {db_instance.id} is using the default master username."

            findings.append(report)

        return findings

References