Securing Publicly Accessible AWS RDS Instances

import boto3 from botocore.exceptions import BotoCoreError, ClientError reg=None # Runs for specific region if provided otherwise runs for all regions if None/nothing is provided. creds = _get_creds(cred_label)['creds'] access_key = creds['username'] secret_key = creds['password'] def list_all_rds_instances(region=None): try: if region: regions = [region] else: # If region is None, list instances in all available regions ec2 = boto3.client('ec2', aws_access_key_id=access_key,aws_secret_access_key=secret_key,region_name='us-east-1') regions = [region['RegionName'] for region in ec2.describe_regions()['Regions']] all_instances = [] for region in regions: #print(f"Listing RDS instances in region {region}:") client = boto3.client('rds', aws_access_key_id=access_key,aws_secret_access_key=secret_key,region_name=region) try: db_instances = client.describe_db_instances() region_instances = [instance['DBInstanceIdentifier'] for instance in db_instances['DBInstances']] if region_instances: print(f"Found {len(region_instances)} RDS instances in region {region}:") for instance in region_instances: print(instance) all_instances.append({"region": region, "instance": instance}) else: #print(f"No RDS instances found in region {region}.") p=1 # dummy line to end the conditional block properly except ClientError as e: print(f"Client error in region {region}: {e}") except BotoCoreError as e: print(f"BotoCoreError in region {region}: {e}") except Exception as e: print(f"Unexpected error in region {region}: {e}") return all_instances except Exception as e: print(f"Unexpected error: {e}") instances = list_all_rds_instances(reg) # reg is initialized in input parameters. Runs for specific region if provided otherwise runs for all regions if None/nothing is provided. #print(instances)

import boto3 from botocore.exceptions import BotoCoreError, ClientError creds = _get_creds(cred_label)['creds'] access_key = creds['username'] secret_key = creds['password'] def filter_public_rds_instances(all_instances): public_instances = [] try: for instance_info in all_instances: region = instance_info['region'] instance = instance_info['instance'] print(f"Checking for public accessibility of RDS instance {instance} in region {region}:") client = boto3.client('rds', aws_access_key_id=access_key,aws_secret_access_key=secret_key,region_name=region) try: instance_details = client.describe_db_instances(DBInstanceIdentifier=instance) if instance_details['DBInstances'][0]['PubliclyAccessible']: public_instances.append({"region": region, "instance": instance}) print(f"{instance} in region {region} is publicly accessible.") except ClientError as e: print(f"Client error with instance {instance} in region {region}: {e}") except BotoCoreError as e: print(f"BotoCoreError with instance {instance} in region {region}: {e}") except Exception as e: print(f"Unexpected error with instance {instance} in region {region}: {e}") if not public_instances: print("No publicly accessible RDS instances found in the provided list.") except Exception as e: print(f"Unexpected error: {e}") return public_instances # Example list of all RDS instances and regions. Replace this with the actual data from your AWS account. # all_instances = [{'region': 'us-east-1', 'instance': 'database-1'},{'region': 'us-west-1', 'instance': 'database-1'}] # Example data # instances passed down from parent task all_instances = instances public_instances = filter_public_rds_instances(all_instances) #print(public_instances) context.proceed = False

import boto3 from botocore.exceptions import BotoCoreError, ClientError def modify_rds_to_private(db_instance_info_list): try: for db_info in db_instance_info_list: region = db_info['region'] identifier = db_info['instance'] client = boto3.client('rds', region_name=region) try: # Retrieve the DB instance information instance_info = client.describe_db_instances(DBInstanceIdentifier=identifier) instance = instance_info['DBInstances'][0] instance_status = instance['DBInstanceStatus'] publicly_accessible = instance['PubliclyAccessible'] # Check if the instance is already private if not publicly_accessible: print(f"Instance {identifier} in region {region} is already private. Skipping modification.") continue # Check if the instance is in the 'available' state if instance_status != 'available': print(f"Instance {identifier} in region {region} is not in 'available' state. Currently in '{instance_status}' state. Skipping modification.") continue # Skip to the next iteration for other instances # If instance is available and public, proceed with modification client.modify_db_instance( DBInstanceIdentifier=identifier, PubliclyAccessible=False ) print(f"Modified {identifier} in region {region} to be private.") except ClientError as e: print(f"Client error with instance {identifier} in region {region}: {e}") except BotoCoreError as e: print(f"BotoCoreError with instance {identifier} in region {region}: {e}") except Exception as e: print(f"Unexpected error with instance {identifier} in region {region}: {e}") except Exception as e: print(f"Unexpected error: {e}") # Example input list of dictionaries. Replace this with your actual data. # db_instance_info_list = [{'region': 'us-east-1', 'instance': 'database-1'},{'region': 'us-west-1', 'instance': 'database-1'}] # Example data # public_instances passed down from parent task db_instance_info_list = public_instances if db_instance_info_list: modify_rds_to_private(db_instance_info_list) else: print("No RDS Instances provided for modification.")