RDS.24: RDS uses a default admin username

What does AWS Security Hub RDS.24 check?

RDS.24 checks the master administrator username on an RDS DB cluster. It reports FAILED when the MasterUsername matches a documented default such as admin, postgres, root, sa, mysql, or master.

Why does RDS.24 matter?

The master user is the highest-privilege account on the database, and its name is fixed at creation — there is no in-place rename. Accepting a default username hands an attacker half the credential pair for free: a brute-force or credential-stuffing campaign now only has to guess the password, not the username. A non-obvious admin name shrinks the attack surface from two unknowns to one for the entire lifetime of the cluster.

How do I fix RDS.24?

1. Adopt a non-default master username convention and enforce it in IaC templates so new clusters never fail this control.
2. For existing clusters, plan a migration — snapshot, restore (or stand up a new cluster) with a custom MasterUsername, and cut traffic over in a maintenance window.
3. Inventory the backlog of clusters on default usernames and schedule the migrations rather than deferring them.

# Move the highest-impact databases onto IAM authentication first (free, no reboot).
for db in $(aws rds describe-db-instances \
    --query 'DBInstances[?IAMDatabaseAuthenticationEnabled==`false`].DBInstanceIdentifier' \
    --output text); do
  aws rds modify-db-instance --db-instance-identifier "$db" \
    --enable-iam-database-authentication --apply-immediately
  echo "$db: IAM database authentication enabled"
done

# Find every instance still using a default admin username (immutable; needs migration).
aws rds describe-db-instances \
  --query "DBInstances[?contains(['admin','postgres','root','sa','master','mysql','dbadmin'], MasterUsername)].[DBInstanceIdentifier,MasterUsername]" \
  --output table

# Recreate one of those with a non-default master username set explicitly at creation.
aws rds restore-db-cluster-from-snapshot \
  --db-cluster-identifier prod-orders-db-v2 \
  --snapshot-identifier prod-orders-db-pre-rename \
  --engine aurora-postgresql