RDS.12: IAM auth should be configured for RDS clusters

What does AWS Security Hub RDS.12 check?

RDS.12 checks whether IAM database authentication is enabled on an RDS DB cluster (AWS::RDS::DBCluster: Aurora MySQL, Aurora PostgreSQL, and Multi-AZ DB clusters). It is change-triggered and reports FAILED for any cluster without the feature turned on. It is the cluster counterpart to RDS.10's instance check.

Why does RDS.12 matter?

A cluster relying solely on database passwords carries long-lived static secrets that must be created, rotated, distributed, and revoked by hand, and that leak into config files, environment variables, and CI logs, rarely getting rotated on schedule. IAM authentication replaces the standing password with a token that AWS issues fresh, expires in 15 minutes, and is governed by the same IAM policies as the rest of your AWS access. It maps to several NIST 800-53 access-management requirements.

How do I fix RDS.12?

1. Enable it on the cluster with modify-db-cluster --enable-iam-database-authentication (non-disruptive; password connections keep working).
2. Create DB users granted the engine auth role (rds_iam for PostgreSQL, AWSAuthenticationPlugin for MySQL).
3. Grant rds-db:connect on the cluster's dbuser ARN to each workload's IAM role and switch clients to token-based connections.
4. Retire static passwords to break-glass only once traffic has migrated.

# Move the highest-impact databases onto IAM authentication first (free, no reboot).
for db in $(aws rds describe-db-instances \
    --query 'DBInstances[?IAMDatabaseAuthenticationEnabled==`false`].DBInstanceIdentifier' \
    --output text); do
  aws rds modify-db-instance --db-instance-identifier "$db" \
    --enable-iam-database-authentication --apply-immediately
  echo "$db: IAM database authentication enabled"
done

# Find every instance still using a default admin username (immutable; needs migration).
aws rds describe-db-instances \
  --query "DBInstances[?contains(['admin','postgres','root','sa','master','mysql','dbadmin'], MasterUsername)].[DBInstanceIdentifier,MasterUsername]" \
  --output table

# Recreate one of those with a non-default master username set explicitly at creation.
aws rds restore-db-cluster-from-snapshot \
  --db-cluster-identifier prod-orders-db-v2 \
  --snapshot-identifier prod-orders-db-pre-rename \
  --engine aurora-postgresql