AWS RDS instances are used to store large volumes of confidential data and organizations cannot afford to risk this data at any cost. Therefore, it is the need-of-the-hour to follow certain security best practices related to the master username of your RDS databases. This will help in securing your infrastructure and minimize the risk of security attacks to protect the crucial data from breaches and leaks.
Why do you need to change the default master name of AWS RDS database?
The master username of Amazon RDS Database is the alphanumeric name which you can use to acquire access to the database instance. Master username is provided by the user when the database is created for the first time. This username is used to login to the database in the database instance for the first time.
AWS gives an example and sets the default master username – ‘awsuser’. Many times, the user does not change this username and leaves it as it is. Many AWS customers tend to use this username for their RDS databases to escape the effort of creating a new username. Unauthorized users can use this information and use the default master username (‘awsuser’) for brute-force attacks. And just in case they succeed to penetrate, the entire security of your AWS RDS database gets compromised. Hence, it is recommended for the users to set a different username which avoids security breaches, misuse of cloud resources and contributes to a secure cloud infrastructure.
Centilytics provides an insight which detects such databases that have the default master username and allows the user to take necessary actions against it.
Insight descriptions:
There can be 2 possible scenarios:
| Severity | Description |
 CRITICAL |
This indication will be displayed when the corresponding AWS RDS instance has the default master username and is not secure. |
 OK |
This indication will be displayed when the corresponding AWS RDS instance has a different master username and is secure. |
Description of further columns are as follows:
1.Account Id: This column shows the respective account ID of the user’s account.
- Account Name: This column shows the corresponding account name of the user’s account.
- Region: This column shows the region in which the resource exists.
- DB Instance Identifier: This column shows the name of the database instance in your AWS RDS.
- Master User status: This column shows the status of whether the master username is secure or not.
Filters applicable:
| Filter Name | Description |
| Account Id | Applying account Id filter will display data for the selected account Id. |
| Region | Applying the region filter will display data according to the selected region. |
| Severity | Applying severity filter will display data according to the selected severity type i.e. selecting critical will display all resources with critical severity. Same will be the case for warning and ok severity types |
| Resource Tags | Applying resource tags filter will display those resources which have been assigned the selected resource tag. For e.g., A user has tagged some resource by a tag named environment. Then selecting an environment from the resource tags filter will display the data accordingly. |
| Resource Tags Value | Applying resource tags value filter will display data which will have the selected resource tag value. For e.g. – Let’s say a user has tagged some resource by a tag named environment and has a value say production (environment:production). Hence, the user can view data of all the resources which are tagged as “environment:production”. The user can use the tag value filter only when a tag name has been provided. |