AWS RDS PostgreSQL exposed to local file read vulnerability misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_250
Category - Subcategory	Public Exposure - Database Endpoints
Provider	AWS
Severity	MEDIUM
Framework	Terraform
Mapped CSPM/KSPM Rule	90d41de0-e234-481f-8f62-6215c87cbd01

Impact

The log_fdw extension for Amazon Relational Database Service (AWS RDS) PostgreSQL instances allows you to query log files from foreign servers as if they were tables in a database. However, certain versions of the log_fdw extension may contain vulnerabilities that can be exploited by attackers. By ensuring that your AWS RDS PostgreSQL instances use a non-vulnerable version of the log_fdw extension, you can help protect your database from potential security threats.

How to Fix

[source,go]

resource "aws_db_instance" "pass" { name = "name" instance_class = "db.t3.micro" engine = "postgres" engine_version = "13.3" }

resource "aws_rds_cluster" "pass" { engine = "aurora-postgresql" engine_version = "11.9" }