RDS.24: RDS uses a default admin username

What does AWS Security Hub RDS.24 check?

RDS.24 checks the master administrator username on an RDS DB cluster. It reports FAILED when the MasterUsername is left at one of the engine defaults (admin or postgres), which are the only values the backing Config rule rds-cluster-default-admin-check treats as non-compliant. The control does not apply to Neptune or DocumentDB clusters.

Why does RDS.24 matter?

The master user is the highest-privilege account on the database, and its name is fixed at creation: there is no in-place rename. Accepting a default username hands an attacker half the credential pair for free: a brute-force or credential-stuffing campaign now only has to guess the password, not the username. A non-obvious admin name shrinks the attack surface from two unknowns to one for the entire lifetime of the cluster.

How do I fix RDS.24?

1. Adopt a non-default master username convention and enforce it in IaC templates so new clusters never fail this control.
2. For existing clusters, plan a migration: snapshot, restore (or stand up a new cluster) with a custom MasterUsername, and cut traffic over in a maintenance window.
3. Inventory the backlog of clusters on default usernames and schedule the migrations rather than deferring them.

# Move the highest-impact databases onto IAM authentication first (free, no reboot).
for db in $(aws rds describe-db-instances \
    --query 'DBInstances[?IAMDatabaseAuthenticationEnabled==`false`].DBInstanceIdentifier' \
    --output text); do
  aws rds modify-db-instance --db-instance-identifier "$db" \
    --enable-iam-database-authentication --apply-immediately
  echo "$db: IAM database authentication enabled"
done

# Find every instance still using a default admin username (immutable; needs migration).
aws rds describe-db-instances \
  --query "DBInstances[?contains(['admin','postgres','root','sa','master','mysql','dbadmin'], MasterUsername)].[DBInstanceIdentifier,MasterUsername]" \
  --output table

# Recreate one of those with a non-default master username set explicitly at creation.
aws rds restore-db-cluster-from-snapshot \
  --db-cluster-identifier prod-orders-db-v2 \
  --snapshot-identifier prod-orders-db-pre-rename \
  --engine aurora-postgresql