tarekcheikh/rds-security-scanner repository overview

⁠RDS Security Scanner

A comprehensive AWS RDS and Aurora security scanner with multi-framework compliance mapping. It audits RDS instances, Aurora clusters, database snapshots, and account-level database settings for security misconfigurations and compliance gaps. The scanner is read-only and never modifies AWS resources.

• Source and full docs: https://github.com/TocConsulting/rds-security-scanner⁠
• License: MIT
• Image runs as root so a mounted host ~/.aws is readable (see Credentials).

⁠Quick Start

docker pull tarekcheikh/rds-security-scanner:latest

# Show help
docker run --rm tarekcheikh/rds-security-scanner --help

# Run a scan with mounted AWS credentials, writing reports to ./output
docker run --rm \
  -v ~/.aws:/root/.aws:ro \
  -v "$(pwd)/output:/app/output" \
  tarekcheikh/rds-security-scanner security -r us-east-1

The image ENTRYPOINT is rds-security-scanner, so arguments after the image name are passed straight to the CLI (for example security, --help).

⁠Credentials

The container reads AWS credentials either from a mounted profile directory or from environment variables. The image intentionally runs as root so that a host ~/.aws/credentials file (mode 0600, owned by your user) is readable inside the container.

Mounted profile (supports -p/--profile):

docker run --rm \
  -v ~/.aws:/root/.aws:ro \
  -v "$(pwd)/output:/app/output" \
  tarekcheikh/rds-security-scanner security -p production -r eu-west-1

Environment variables (including temporary/assumed-role credentials):

docker run --rm \
  -e AWS_ACCESS_KEY_ID \
  -e AWS_SECRET_ACCESS_KEY \
  -e AWS_SESSION_TOKEN \
  -e AWS_DEFAULT_REGION=us-east-1 \
  -v "$(pwd)/output:/app/output" \
  tarekcheikh/rds-security-scanner security

Note: IAM Identity Center (SSO) sessions do not resolve inside the container. Export process credentials first (for example aws configure export-credentials --format env) and pass them as environment variables.

⁠What It Checks

Checks span 7 categories across instances, Aurora clusters, snapshots, and account settings, using a four-tier model (account, standalone instance, Aurora cluster, Aurora member) to avoid double-counting:

• A. Encryption: storage encryption at rest, SSL/TLS enforcement, customer- managed KMS keys, CA-certificate currency.
• B. Network and Access Control: public accessibility, security groups open to 0.0.0.0/0, IAM database authentication, non-default port, public snapshot sharing, subnet groups.
• C. Logging and Monitoring: CloudWatch log exports, Enhanced Monitoring, Performance Insights, Database Activity Streams, event subscriptions.
• D. Backup and Recovery: retention period, deletion protection, Multi-AZ, copy-tags-to-snapshot, Aurora backtrack.
• E. Maintenance and Patching: auto minor version upgrade, pending maintenance.
• F. Configuration: custom parameter groups, Secrets Manager master credentials, VPC placement, RDS Proxy TLS and IAM auth.
• G. Tagging: required tags on instances, clusters, snapshots, subnet groups, parameter groups, and event subscriptions.

Checks adapt per engine (MySQL, PostgreSQL, MariaDB, Oracle, SQL Server, and the Aurora variants); unsupported checks are reported as N/A rather than a failure.

⁠Compliance Frameworks

Controls mapped across 10 frameworks:

• AWS Foundational Security Best Practices (FSBP)
• CIS-based RDS hardening baseline
• PCI DSS v4.0.1
• HIPAA Security Rule
• SOC 2
• ISO 27001:2022
• ISO 27017:2015
• ISO 27018:2019
• GDPR (EU) 2016/679
• NIST SP 800-53 Rev. 5

Mapping database-only checks to broad governance frameworks is partial technical evidence, not a compliance attestation.

⁠Output

Each scan produces a per-resource 0-100 security score and reports in the mounted output directory (default /app/output in the container, mapped to ./output):

• JSON: full results with summary and per-resource detail
• CSV: flattened per-resource findings for spreadsheets
• HTML: interactive dashboard with charts
• Compliance JSON: per-framework pass/fail breakdown

Select the format with -f json|csv|html|all (default all).

⁠Required IAM Permissions

The scanner needs read-only access only: rds:Describe*, rds:ListTagsForResource, ec2:DescribeSecurityGroups, kms:DescribeKey, and sts:GetCallerIdentity. The full minimal policy is in the repository README. The scanner performs no write or delete actions.

⁠Tags

• latest: most recent release
• 1.0.0: pinned version

Images are published for linux/amd64 and linux/arm64.

⁠Links

• Repository: https://github.com/TocConsulting/rds-security-scanner⁠
• Issues: https://github.com/TocConsulting/rds-security-scanner/issues⁠
• PyPI (pip install): https://pypi.org/project/rds-security-scanner/⁠