Back to Checks
aws

RDS instance has IAM database authentication enabled

rds_instance_iam_authentication_enabled
Service: rdsSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:AwsRdsDbInstance

RDS DB instances using MySQL, MariaDB, or PostgreSQL engines (including Aurora variants) have IAM database authentication enabled at the instance level or, when part of a cluster, evaluated for cluster-level enablement.

Prowler logoProwlerprowler-provider-aws

Risk

Absent IAM-based, short-lived tokens, databases rely on static passwords in code and configs, increasing theft and reuse.

Compromised DB creds enable unauthorized queries, leading to data exfiltration and tampering, and weaken centralized access control and rotation.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks rds_instance_iam_authentication_enabled

Recommendation

Enable IAM database authentication for supported engines and apply least privilege with scoped IAM policies. Prefer short-lived tokens over static DB passwords, enforce TLS, and phase out embedded credentials.

Monitor authentication activity with audit logs for defense in depth.

Remediation

CLI

aws rds modify-db-instance --db-instance-identifier <DB_INSTANCE_ID> --enable-iam-database-authentication --apply-immediately

Terraform

# Enable IAM DB authentication on an RDS instance
resource "aws_db_instance" "<example_resource_name>" {
  iam_database_authentication_enabled = true  # Critical: enables IAM DB auth to pass the check
}

NativeIaC

# CloudFormation: enable IAM DB authentication on an RDS instance
Resources:
  <example_resource_name>:
    Type: AWS::RDS::DBInstance
    Properties:
      DBInstanceIdentifier: <example_resource_id>
      EnableIAMDatabaseAuthentication: true  # Critical: enables IAM DB auth to pass the check

Other

1In the AWS console, go to RDS > Databases
2Select the DB instance and choose Modify
3Under Database authentication, select "Password and IAM database authentication"
4Choose Apply immediately and click Modify DB instance
5If the instance is part of an Aurora DB cluster: select the DB cluster instead, choose Modify, enable IAM database authentication, Apply immediately, then Modify

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.rds.rds_client import rds_client


class rds_instance_iam_authentication_enabled(Check):
    def execute(self):
        supported_engines = [
            "postgres",
            "aurora-postgresql",
            "mysql",
            "mariadb",
            "aurora-mysql",
            "aurora",
        ]
        findings = []
        for db_instance in rds_client.db_instances.values():
            if any(engine in db_instance.engine for engine in supported_engines):
                report = Check_Report_AWS(
                    metadata=self.metadata(), resource=db_instance
                )
                # Check if is member of a cluster
                if db_instance.cluster_id:
                    if db_instance.iam_auth:
                        report.status = "PASS"
                        report.status_extended = f"RDS Instance {db_instance.id} has IAM authentication enabled at cluster {db_instance.cluster_id} level."
                    else:
                        report.status = "FAIL"
                        report.status_extended = f"RDS Instance {db_instance.id} does not have IAM authentication enabled at cluster {db_instance.cluster_id} level."
                else:
                    if db_instance.iam_auth:
                        report.status = "PASS"
                        report.status_extended = f"RDS Instance {db_instance.id} has IAM authentication enabled."
                    else:
                        report.status = "FAIL"
                        report.status_extended = f"RDS Instance {db_instance.id} does not have IAM authentication enabled."

                findings.append(report)

        return findings

References