SH405: Database reachable from the internet

Severity: high · Category: security · Applies to: cloudformation, terraform

Why it matters

A database with a public address is exposed to the internet and to brute-force and exploit attempts, even when a security group limits who can connect.

How to fix

Set publicly_accessible = false and reach the database through a private subnet, a VPN or a bastion host.

Ignoring this rule

Skip it everywhere in devshield.yml:

ignore:
  - SH405

Or skip one line with a comment on that line or the line above:

devshield-ignore: SH405