Checks whether an ApsaraDB RDS instance has Internet access disabled or its IP address whitelist does not contain 0.0.0.0/0.
Scenarios
Adding 0.0.0.0/0 to the whitelist of an ApsaraDB RDS instance allows access from all IP addresses over the Internet, which poses significant security risks.
Risk level
Default risk level: high.
You can change the risk level based on your business requirements when you apply this rule.
Compliance evaluation logic
- If Internet access is disabled for the ApsaraDB RDS instance, or if Internet access is enabled but the whitelist does not contain 0.0.0.0/0, the evaluation result is Compliant.
- If Internet access is enabled for the ApsaraDB RDS instance and the whitelist contains 0.0.0.0/0, the evaluation result is Incompliant. To remediate an incompliant configuration, see the "Incompliance remediation" section of this topic.
Rule details
| Item | Description |
| Rule name | rds-public-and-any-ip-access-check |
| Rule identifier | rds-public-and-any-ip-access-check |
| Tag | RDS and Public |
| Automatic remediation | Not supported |
| Trigger type | Configuration change |
| Supported resource type | ApsaraDB RDS instances |
| Input parameter | None |
Incompliance remediation
Disable Internet access for ApsaraDB RDS instances or remove 0.0.0.0/0 from the instance whitelists. For more information, see Configure an IP address whitelist.