Back to Checks
aws

RDS instance uses a non-default port for its engine

rds_instance_non_default_port
Service: rdsSeverity: low
OfficialBuilt-inVerified
Resource Type:AwsRdsDbInstance

RDS DB instances are evaluated for use of a port that differs from the engine's default. Matching an engine with its default port-3306 (MySQL/MariaDB/Aurora MySQL), 5432 (PostgreSQL/Aurora), 1521 (Oracle), 1433 (SQL Server), 50000 (Db2)-indicates the instance uses the default listener.

Prowler logoProwlerprowler-provider-aws

Risk

Using a default DB port increases exposure to broad scans and eases service fingerprinting. With weak network controls, attackers can run credential brute force, target known engine exploits, or trigger DoS on the predictable port, threatening confidentiality and availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks rds_instance_non_default_port

Recommendation

Use a non-default DB port and enforce defense in depth:

  • Apply least-privilege network rules
  • Keep databases in private subnets; avoid public exposure
  • Require strong authentication and audit logging

Update client connection strings and security rules when the port changes.

Remediation

CLI

aws rds modify-db-instance --db-instance-identifier <db-instance-id> --db-port <non-default-port>

Terraform

# Terraform: set a non-default port on an RDS instance
resource "aws_db_instance" "<example_resource_name>" {
  port = <non-default-port>  # Critical: use a non-default DB engine port to pass the check
}

NativeIaC

# CloudFormation: set a non-default port on an RDS instance
Resources:
  <example_resource_name>:
    Type: AWS::RDS::DBInstance
    Properties:
      Port: <non-default_port>  # Critical: use a non-default DB engine port to pass the check

Other

1In the AWS Console, go to Amazon RDS > Databases
2Select the DB instance and click Modify
3Set "Database port" to a non-default value for the engine (e.g., not 3306, 5432, 1521, 1433, or 50000)
4Click Continue, then Modify DB instance

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.rds.rds_client import rds_client


class rds_instance_non_default_port(Check):
    def execute(self):
        findings = []
        default_ports = {
            3306: ["mysql", "mariadb", "aurora-mysql"],
            5432: ["postgres", "aurora-postgresql"],
            1521: ["oracle"],
            1433: ["sqlserver"],
            50000: ["db2"],
        }
        for db_instance in rds_client.db_instances.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=db_instance)
            report.status = "PASS"
            report.status_extended = (
                f"RDS Instance {db_instance.id} is not using the default port "
                f"{db_instance.port} for {db_instance.engine}."
            )
            if db_instance.port in default_ports:
                default_engines = default_ports[db_instance.port]
                for default_engine in default_engines:
                    if default_engine in db_instance.engine.lower():
                        report.status = "FAIL"
                        report.status_extended = (
                            f"RDS Instance {db_instance.id} is using the default port "
                            f"{db_instance.port} for {db_instance.engine}."
                        )

            findings.append(report)

        return findings

References