AWS AWSCloudFormation medium security documentation change
Summary
Updated documentation for PubliclyAccessible property to clarify default behavior and error conditions when using DBSubnetGroup
Security assessment
The changes clarify security-critical network accessibility defaults for RDS clusters. Specifically highlights that PubliclyAccessible defaults to true when no DBSubnetGroup is specified, and adds an error condition when public access is enabled without an internet gateway. This helps prevent accidental public exposure of databases.
Diff
diff --git a/AWSCloudFormation/latest/TemplateReference/aws-resource-rds-dbcluster.md b/AWSCloudFormation/latest/TemplateReference/aws-resource-rds-dbcluster.md index 9a3427941..1aee1eec2 100644 --- a//AWSCloudFormation/latest/TemplateReference/aws-resource-rds-dbcluster.md +++ b//AWSCloudFormation/latest/TemplateReference/aws-resource-rds-dbcluster.md @@ -1122,4 +1121,0 @@ Specifies whether the DB cluster is publicly accessible. -When the DB cluster is publicly accessible and you connect from outside of the DB cluster's virtual private cloud (VPC), its Domain Name System (DNS) endpoint resolves to the public IP address. When you connect from within the same VPC as the DB cluster, the endpoint resolves to the private IP address. Access to the DB cluster is ultimately controlled by the security group it uses. That public access isn't permitted if the security group assigned to the DB cluster doesn't permit it. - -When the DB cluster isn't publicly accessible, it is an internal DB cluster with a DNS name that resolves to a private IP address. - @@ -1128,7 +1124 @@ Valid for Cluster Type: Multi-AZ DB clusters only -Default: The default behavior varies depending on whether `DBSubnetGroupName` is specified. - -If `DBSubnetGroupName` isn't specified, and `PubliclyAccessible` isn't specified, the following applies: - - * If the default VPC in the target Region doesn’t have an internet gateway attached to it, the DB cluster is private. - - * If the default VPC in the target Region has an internet gateway attached to it, the DB cluster is public. +When the DB cluster is publicly accessible and you connect from outside of the DB cluster's virtual private cloud (VPC), its domain name system (DNS) endpoint resolves to the public IP address. When you connect from within the same VPC as the DB cluster, the endpoint resolves to the private IP address. Access to the DB cluster is controlled by its security group settings. @@ -1135,0 +1126 @@ If `DBSubnetGroupName` isn't specified, and `PubliclyAccessible` isn't specified +When the DB cluster isn't publicly accessible, it is an internal DB cluster with a DNS name that resolves to a private IP address. @@ -1136,0 +1128 @@ If `DBSubnetGroupName` isn't specified, and `PubliclyAccessible` isn't specified +The default behavior when `PubliclyAccessible` is not specified depends on whether a `DBSubnetGroup` is specified. @@ -1137,0 +1130 @@ If `DBSubnetGroupName` isn't specified, and `PubliclyAccessible` isn't specified +If `DBSubnetGroup` isn't specified, `PubliclyAccessible` defaults to `true`. @@ -1139,7 +1132 @@ If `DBSubnetGroupName` isn't specified, and `PubliclyAccessible` isn't specified -If `DBSubnetGroupName` is specified, and `PubliclyAccessible` isn't specified, the following applies: - - * If the subnets are part of a VPC that doesn’t have an internet gateway attached to it, the DB cluster is private. - - * If the subnets are part of a VPC that has an internet gateway attached to it, the DB cluster is public. - - +If `DBSubnetGroup` is specified, `PubliclyAccessible` defaults to `false` unless the value of `DBSubnetGroup` is `default`, in which case `PubliclyAccessible` defaults to `true`. @@ -1146,0 +1134 @@ If `DBSubnetGroupName` is specified, and `PubliclyAccessible` isn't specified, t +If `PubliclyAccessible` is true and the VPC that the `DBSubnetGroup` is in doesn't have an internet gateway attached to it, Amazon RDS returns an error.