AWS RDS Instance Modified to be Publicly Accessible

Description

Detects when an RDS instance or cluster is modified to become publicly accessible. This exposes the database to the internet and is used by attackers for persistence or data exfiltration. This detects the modification event in real-time, unlike static policy checks.

Query · python

from panther_aws_helpers import aws_rds_context


def rule(event):
    if event.get("eventSource") != "rds.amazonaws.com":
        return False
    modify_events = ["ModifyDBInstance", "ModifyDBCluster"]
    if event.get("eventName") not in modify_events:
        return False
    if event.deep_get("errorCode") is not None:
        return False
    publicly_accessible = event.deep_get("requestParameters", "publiclyAccessible", default=None)
    if publicly_accessible is True:
        return True
    return False


def title(event):
    event_name = event.get("eventName", "Unknown")
    db_identifier = event.deep_get("requestParameters", "dBInstanceIdentifier") or event.deep_get(
        "requestParameters", "dBClusterIdentifier", default="<UNKNOWN>"
    )
    user = event.deep_get("userIdentity", "userName") or event.deep_get(
        "userIdentity", "principalId", default="<UNKNOWN_USER>"
    )
    resource_type = "Instance" if event_name == "ModifyDBInstance" else "Cluster"
    return f"RDS {resource_type} Made Public: [{db_identifier}] by [{user}]"


def alert_context(event):
    context = aws_rds_context(event)
    context["publicly_accessible"] = event.deep_get(
        "requestParameters", "publiclyAccessible", default="N/A"
    )
    context["apply_immediately"] = event.deep_get(
        "requestParameters", "applyImmediately", default="N/A"
    )
    vpc_security_groups = event.deep_get("requestParameters", "vPCSecurityGroupIds", default=None)
    if vpc_security_groups:
        context["vpc_security_groups_modified"] = vpc_security_groups
    subnet_group = event.deep_get("requestParameters", "dBSubnetGroupName")
    if subnet_group:
        context["subnet_group_modified"] = subnet_group
    return context

Analyst notes

Find all RDS modification events by the user ARN in the 24 hours before the alert
Check if this database has been made public before by searching for ModifyDBInstance events with publiclyAccessible in the past 90 days
Look for database connection attempts from external IPs in the 6 hours after this modification
Find all API calls from the sourceIPAddress in the 6 hours before and after the alert to identify other suspicious modifications
Immediately revert publiclyAccessible to false if unauthorized, then review VPC security groups for overly permissive rules (0.0.0.0/0)
Check RDS database logs for any access attempts from external IPs in the time window after this modification

Detection tier

Atomic IOCs
Network & Host Artifacts
Tools
TTPs
Pending classification

Metadata

Source: panther-labs/panther-analysis
License: Apache 2.0
Severity: Critical
Status: Stable
Query type: python
Created: 2026-04-20
Modified: 2026-05-05
Authored by: panther-labs
Source ID
Upstream: rules/aws_cloudtrail_rules/aws_rds_instance_made_public.yml
Type: rule
Version: 2
References: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_VPC.WorkingWithRDSInstanceinaVPC.html
Data sources: AWS.CloudTrail

ATT&CK

TA0001TA0003TA0005 T1098 T1133 T1562.007