cyberstrikeus 2.6 Ensure Passwords are Regularly Rotated (Manual)
Description
Regularly rotating your Aurora passwords is critical to access management, contributing to maintaining system security. The database password can be rotated in Amazon Aurora, but the access keys refer to the rotation of AWS IAM User access keys.
Rationale
Updating your password is critical to access AWS resources. This also ensures that your account is being kept safe from a potential threat.
Impact
Having the passwords updated frequently allows only the authorized individual to access the AWS resources.
Audit Procedure
Using AWS Console
Sign in to AWS Management Console
- If you do not already have an AWS account, you will need to create one at https://aws.amazon.com.
Navigate to Amazon RDS Dashboard
- Navigate to the RDS service once logged in to the AWS Management Console. You can find this under the
Databasecategory.
- Navigate to the RDS service once logged in to the AWS Management Console. You can find this under the
Choose your Aurora DB instance
- In the RDS Dashboard, click on
Databases, and then click on the name of your Aurora DB instance.
- In the RDS Dashboard, click on
Modify the instance
- Click
Modify. - In the
Settingssection, enter a new password in theMaster passwordandConfirm passwordfields.
- Click
Apply the changes
- Scroll to the bottom and choose when to apply the changes. You can apply them immediately or schedule them for the next maintenance window.
- Then, click
ContinueandModify DB Instance.
Note: Changing the master password will reboot the DB instance if you apply the change immediately.
Expected Result
The Aurora DB instance master password should be rotated on a regular schedule according to organizational password policies.
Remediation
Follow the audit procedure steps above to rotate Aurora database passwords. Consider using AWS Secrets Manager for automated password rotation.
Default Value
AWS does not enforce automatic password rotation for Aurora database master passwords by default.
References
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 5.2 Use Unique Passwords - Use unique passwords for all enterprise assets. Best practice implementation includes, at a minimum, an 8-character password for accounts using MFA and a 14-character password for accounts not using MFA. | x | x | x |
| v7 | 4.4 Use Unique Passwords - Where multi-factor authentication is not supported (such as local administrator, root, or service accounts), accounts will use passwords that are unique to that system. | x | x |
Profile
Level 1 | Manual