Service: AWS RDS

AWS RDS DB Instance Made Public

Aug 24, 2026 · Domain: Cloud Platform: AWS Data Source: AWS CloudTrail Service: AWS RDS Tactic: Defense Evasion Tactic: Persistence Rule Type: Event Correlation (EQL) Resources: Investigation Guide ·

Share on:

Identifies the creation or modification of an Amazon RDS DB instance or cluster where the "publiclyAccessible" attribute is set to "true". Publicly accessible RDS instances expose a network endpoint on the public internet, which may allow unauthorized access if combined with overly permissive security groups, weak authentication, or misconfigured IAM policies. Adversaries may enable public access on an existing instance, or create a new publicly accessible instance, to establish persistence, move data outside of controlled network boundaries, or bypass internal access controls.

AWS RDS DB Instance or Cluster Deleted

Aug 24, 2026 · Domain: Cloud Platform: AWS Data Source: AWS CloudTrail Service: AWS RDS Tactic: Impact Rule Type: Custom Query (KQL) Resources: Investigation Guide ·

Share on:

Identifies the deletion of an Amazon RDS DB instance, Aurora cluster, or global database cluster. Deleting these resources permanently destroys stored data and can cause major service disruption. Adversaries with sufficient permissions may delete RDS resources to impede recovery, destroy evidence, or inflict operational impact on the environment.

AWS RDS DB Instance or Cluster Deletion Protection Disabled

Aug 24, 2026 · Domain: Cloud Platform: AWS Data Source: AWS CloudTrail Service: AWS RDS Tactic: Impact Rule Type: Event Correlation (EQL) Resources: Investigation Guide ·

Share on:

Identifies the modification of an AWS RDS DB instance or cluster to disable the deletionProtection feature. Deletion protection prevents accidental or unauthorized deletion of RDS resources. Adversaries with sufficient permissions may disable this protection as a precursor to destructive actions, including the deletion of databases containing sensitive or business-critical data. This rule alerts when deletionProtection is explicitly set to false on an RDS DB instance or cluster.