Back to Checks
huaweicloud

RDS instances are not publicly accessible

rds_public_access
Service: rdsSeverity: critical
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:NotDefined

Ensure that Huawei Cloud Relational Database Service (RDS) instances do not have public IP addresses to prevent direct internet access to databases.

Prowler logoProwlerprowler-provider-huaweicloud

Risk

RDS instances with public IP addresses are accessible from the internet, exposing databases to potential brute-force attacks, SQL injection, and unauthorized data access.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler huaweicloud --checks rds_public_access

Recommendation

Remove public IP addresses from RDS instances and use VPC peering or VPN for access.

Remediation

CLI

hcloud EIP DisassociatePublicips --publicip_id=<eip_id>

Other

1Log on to the **Huawei Cloud console**.
2Navigate to **Relational Database Service**.
3Select the instance.
4Click **More** > **Unbind EIP**.
5Confirm the unbinding.

Check Code

from prowler.lib.check.models import Check, CheckReportHuaweiCloud
from prowler.providers.huaweicloud.services.rds.rds_client import rds_client


class rds_public_access(Check):
    """Check if RDS instances are not publicly accessible."""

    def execute(self) -> list[CheckReportHuaweiCloud]:
        findings = []

        for instance in rds_client.instances:
            report = CheckReportHuaweiCloud(metadata=self.metadata(), resource=instance)
            report.region = instance.region
            report.resource_id = instance.id
            report.resource_arn = f"huaweicloud:rds:{instance.region}:{rds_client.audited_account}:instance/{instance.id}"

            if instance.is_public:
                report.status = "FAIL"
                report.status_extended = (
                    f"RDS instance {instance.name} ({instance.id}) "
                    f"has a public IP address {instance.public_ip}."
                )
            else:
                report.status = "PASS"
                report.status_extended = (
                    f"RDS instance {instance.name} ({instance.id}) "
                    f"does not have a public IP address."
                )

            findings.append(report)

        return findings

References