Skip to main content

Insecure service configuration - DynamoDB

Description

The DynamoDB service has insecure configurations.

Impact

Access to the database and exploit vulnerabilities in the system configuration to affect the service and have access to stored information.

Recommendation

Set correct configurations and in line with AWS best security practices.

Threat

Unauthorized Internet user with credentials.

Expected Remediation Time

⌚ 30 minutes.

Score

Default score using CVSS 3.1. It may change depending on the context of the vulnerability.

Base

  • Attack vector: N
  • Attack complexity: L
  • Privileges required: N
  • User interaction: N
  • Scope: U
  • Confidentiality: N
  • Integrity: L
  • Availability: L

Temporal

  • Exploit code madurity: X
  • Remediation level: X
  • Report confidence: X

Result

  • Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:X/RL:X/RC:X
  • Score:
    • Base: 6.5
    • Temporal: 6.5
  • Severity:
    • Base: Medium
    • Temporal: Medium

Code Examples

Compliant code

All sensitive resources have restricted access configuration

resource "aws_db_instance" "default" {
allocated_storage = 10
engine = "dynamoDB"
engine_version = "5.7"
instance_class = "db.t3.micro"
name = "mydb"
username = "admin"
password = "encrypted_password"
allowed_groups = admin
}

Non compliant code

The dynamo db service does not have restricted access configuration

resource "aws_db_instance" "default" {
allocated_storage = 10
engine = "dynamoDB"
engine_version = "5.7"
instance_class = "db.t3.micro"
name = "mydb"
username = "admin"
password = "*"
allowed_groups = all
}

Requirements

free trial

Search for vulnerabilities in your apps for free with our automated security testing! Start your 21-day free trial and discover the benefits of our Continuous Hacking Machine Plan. If you prefer a full service that includes the expertise of our ethical hackers, don't hesitate to contact us for our Continuous Hacking Squad Plan.