AWS Neptune Cluster not configured with IAM authentication misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_359
Category - Subcategory	IAM - Authentication Policies
Provider	AWS
Severity	LOW
Framework	Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	48e2b40e-f487-4e94-ac22-a330a829f877

Impact

This rule is checking if Neptune DB clusters in an AWS environment have IAM database authentication enabled. IAM stands for Identity and Access Management, which is a web service that helps control access to AWS resources. IAM authentication facilitates secure access management to the database because it eliminates the need to share and store database credentials. If it's not enabled, it may expose the database to unauthorized access, potentially leading to data breaches or manipulations. Hence, it's bad practice if IAM database authentication is not enabled.

How to Fix

Resource: aws_neptune_cluster

• Arguments: iam_database_authentication_enabled

To fix this issue, you need to enable IAM database authentication for your Neptune DB clusters.

In the above fix, the parameter iam_database_authentication_enabled is set to true for the Neptune DB cluster. This means that IAM Database Authentication is enabled, making usage of database user credentials unnecessary. IAM roles can control who can connect and access the database, boosting security by reducing exposure of database credentials and providing inbuilt features like credential rotation. [source,go]

resource "aws_neptune_cluster" "default" { cluster_identifier = "neptune-cluster-demo" iam_database_authentication_enabled = true ... tags = { Name = "default" Environment = "production" } }