# Cis AWS Database 3.7

> Ensure to Implement Access Control and Authentication

- Skill: `cyberstrikeus/cis-aws-database-3-7` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-aws-database-3-7`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-aws-database-3-7/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cyberstrikeus/cis-aws-database-3-7

---


# 3.7 Ensure to Implement Access Control and Authentication (Manual)

## Description

Users should select whether they like to enable authentication. If they want to authenticate a password would be required, which would only allow the authorized person to access the database. Defining access control allows specific workers in a business access to the database.

## Rationale

Implementing proper access control and authentication ensures that only authorized users can access the database, reducing the risk of unauthorized data access or modification.

## Impact

Proper access control restricts database access to authorized users only, preventing unauthorized access and potential data breaches.

## Audit Procedure

### Using AWS Console

1. Sign into the AWS Management Console
   - Sign into the AWS Management Console at https://console.aws.amazon.com/ with your AWS account credentials.

2. Open the Amazon RDS Console
   - Navigate to the service using the `Find Services` search bar or by directly accessing the console at https://console.aws.amazon.com/rds/.

3. Select the RDS Instance
   - Choose the Amazon RDS instance you want to implement access control and authentication.
   - Click on the instance name to access its details page.
   - In the instance details page, navigate to the `Configuration` or `Connectivity & Security` section.

4. Enable IAM Database Authentication
   - Under the `Connectivity` or `Connectivity & Security` section.
   - Click the `Modify` or `Edit` option to enable IAM Database Authentication.
   - Select the option to enable IAM Database Authentication.
   - Click `Continue` or `Save` to apply the changes.

5. Create and Configure IAM Database Users
   - Click `Users` in the left-side menu in the Amazon RDS console.
   - Click `Create database user` to create a new IAM database user.
   - Provide a username and select the IAM role or IAM user that will be associated with the database user.
   - Configure the authentication type, either `Password-based` or `IAM authentication`.
   - Set the desired password or leave it blank for IAM authentication.
   - Configure the database user's privileges and permissions based on your application's requirements.
   - Click `Create` to create the IAM database user.

6. Configure Database User Privileges
   - Click `Users` in the left-side menu in the Amazon RDS console.
   - Select the database user you created in the previous step.
   - Click on `Modify` to modify the user's settings and permissions.
   - Configure the user's access privileges, including database access, object permissions, and privileges.
   - Click `Save` or `Apply Changes` to update the user's privileges.

7. Test Access and Authentication
   - Test the access and authentication by connecting to the RDS instance using the IAM database user's credentials or IAM role.
   - Verify that the authentication and access control mechanisms are functioning correctly.

8. Monitor and Manage IAM Database Users
   - Regularly monitor and review the IAM database users and their access privileges.
   - Adjust user privileges as needed based on changes in your application requirements.
   - Remove or disable database users when they are no longer needed.

## Expected Result

IAM Database Authentication should be enabled, and database users should have properly configured access privileges following the principle of least privilege.

## Remediation

### Using AWS Console

Follow the audit steps above to enable IAM Database Authentication and configure proper user privileges. Review and remove any unnecessary database users or excessive privileges.

## Default Value

IAM Database Authentication is disabled by default. Password-based authentication is the default authentication method.

## References

1. https://aws.amazon.com/products/databases/

## CIS Controls

| Controls Version | Control                                               | IG 1 | IG 2 | IG 3 |
| ---------------- | ----------------------------------------------------- | ---- | ---- | ---- |
| v8               | 3.3 Configure Data Access Control Lists               | x    | x    | x    |
| v7               | 14.6 Protect Information through Access Control Lists | x    | x    | x    |

## Profile

Level 1 | Manual