rds-security-scanner 1.0.0

A comprehensive, production-ready AWS RDS / Aurora security scanner with multi-framework compliance mapping. Audits RDS instances, Aurora clusters, database snapshots, and account-level database settings for security vulnerabilities and compliance violations across CIS, AWS FSBP, PCI-DSS, HIPAA, SOC 2, ISO frameworks, GDPR and NIST 800-53.

Features

• 53 security checks across 7 categories
• 10 compliance frameworks with 201 controls
• Four-tier scanning: Account -> Standalone Instance -> Aurora Cluster -> Aurora Member
• Aurora-aware: Handles Aurora clusters and member instances separately to prevent double-counting
• Engine-specific: Adapts checks for MySQL, PostgreSQL, MariaDB, Oracle, SQL Server, and Aurora variants
• Multi-format reports: JSON, CSV, HTML dashboard, compliance JSON
• Parallel scanning with configurable thread pool
• Fail-closed defaults: Missing data assumes the worst

Security Checks

See security-checks.md for the full check catalog.

Compliance Frameworks

See compliance.md for the full mapping.

Quick Start

Installation

pip install .

Basic Usage

# Scan all RDS resources in us-east-1
rds-security-scanner security

# Use a specific AWS profile and region
rds-security-scanner security -p production -r eu-west-1

# Scan specific instances
rds-security-scanner security -i my-database

# Scan specific Aurora clusters
rds-security-scanner security -c my-aurora-cluster

# HTML report only
rds-security-scanner security -f html -o ./reports

# Compliance-focused output
rds-security-scanner security --compliance-only

# Parallel workers and debug mode
rds-security-scanner security -w 10 -d

Docker

docker build -t rds-security-scanner .

docker run --rm \
  -v ~/.aws:/root/.aws:ro \
  -v $(pwd)/output:/app/output \
  rds-security-scanner security -r us-east-1

Output Formats

Scoring

Each resource starts at 100 points. Deductions are applied per failed check:

Score is clamped to a minimum of 0.

IAM Permissions

The scanner requires read-only access. Minimum IAM policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "rds:DescribeDBInstances",
                "rds:DescribeDBClusters",
                "rds:DescribeDBSnapshots",
                "rds:DescribeDBClusterSnapshots",
                "rds:DescribeDBSnapshotAttributes",
                "rds:DescribeDBClusterSnapshotAttributes",
                "rds:DescribeEventSubscriptions",
                "rds:DescribeDBParameterGroups",
                "rds:DescribeDBParameters",
                "rds:DescribeDBClusterParameterGroups",
                "rds:DescribeDBClusterParameters",
                "rds:DescribeDBSubnetGroups",
                "rds:DescribeDBProxies",
                "rds:DescribeOptionGroups",
                "rds:DescribeOptionGroupOptions",
                "rds:DescribePendingMaintenanceActions",
                "rds:ListTagsForResource",
                "ec2:DescribeSecurityGroups",
                "kms:DescribeKey",
                "sts:GetCallerIdentity"
            ],
            "Resource": "*"
        }
    ]
}

kms:DescribeKey is used by check A.7 (CMK usage) to reliably distinguish customer-managed keys from AWS-managed keys (KeyManager property). If you cannot grant it, the scanner falls back to the StorageEncryptionType heuristic and the result will be reported as "unknown" for resources encrypted with a non-default KMS key whose KeyManager cannot be inspected.

Development

# Create virtual environment
python -m venv venv
source venv/bin/activate

# Install with dev dependencies
pip install -e ".[dev]"

# Run tests
pytest tests/ -v

# Run with coverage
pytest tests/ --cov=rds_security_scanner --cov-report=term-missing

# Format code
black rds_security_scanner/ tests/

# Lint
flake8 rds_security_scanner/ tests/

Architecture

rds-security-scanner/
├── rds_security_scanner/
│   ├── __init__.py          # Package metadata
│   ├── cli.py               # Click CLI with shared option decorators
│   ├── scanner.py           # Main orchestrator (4-tier architecture)
│   ├── compliance.py        # 10 frameworks, 201 lambda-based controls
│   ├── utils.py             # Scoring, logging, utilities
│   ├── html_reporter.py     # Jinja2 HTML dashboard generator
│   ├── checks/
│   │   ├── base.py          # BaseChecker with thread-safe session factory
│   │   ├── encryption.py    # Checks A.1-A.8
│   │   ├── network_access.py # Checks B.1-B.10
│   │   ├── logging_monitoring.py # Checks C.1-C.10
│   │   ├── backup_recovery.py # Checks D.1-D.9
│   │   ├── maintenance.py   # Checks E.1-E.3
│   │   ├── configuration.py # Checks F.1-F.6
│   │   └── tagging.py       # Checks G.1-G.7
│   └── templates/
│       └── report.html      # HTML report template
└── tests/                   # 12 test files, 154 tests

License

MIT License - see LICENSE for details.

Author

Toc Consulting - tarek@tocconsulting.fr