Database security hardening

ws traffic only from the application security group const dbSecurityGroup = new aws.ec2.SecurityGroup("db-sg", { vpcId: vpc.id, ingress: [{ protocol: "tcp", fromPort: 5432, toPort: 5432, securityGroups: [appSecurityGroup.id], // Reference SG ID, not CIDR }], egress: [{ protocol: "-1", fromPort: 0, toPort: 0, cidrBlocks: ["0.0.0.0/0"], // Allow egress for patches/updates }], });

const hardenedDb = new aws.rds.Instance("hardened-postgres", { // ... vpcSecurityGroupIds: [dbSecurityGroup.id], dbSubnetGroupName: privateSubnetGroup.name, publiclyAccessible: false, });

### 4. Audit Logging and Monitoring

Enable audit logs to capture connection attempts, privilege changes, and data access patterns. Stream logs to a centralized SIEM.

**Configuration:**
```typescript
const hardenedDb = new aws.rds.Instance("hardened-postgres", {
    // ...
    enabledCloudwatchLogsExports: ["postgresql", "upgrade"],
    performanceInsightsEnabled: true,
    
    // Parameter Group for Audit Settings
    parameterGroupName: dbParameterGroup.name,
});

const dbParameterGroup = new aws.rds.ParameterGroup("audit-params", {
    family: "postgres15",
    parameters: [
        { name: "log_connections", value: "1" },
        { name: "log_disconnections", value: "1" },
        { name: "log_statement", value: "ddl" }, // Log DDL changes
        { name: "log_min_duration_statement", value: "500" }, // Log slow queries > 500ms
    ],
});

Architecture Decision: Use pgAudit for PostgreSQL for more granular object-level auditing if compliance requires it. Stream CloudWatch logs to a dedicated audit account to prevent tampering.

5. Automated Backups and Point-in-Time Recovery

Ensure backups are encrypted and retention policies meet compliance requirements. Enable deletion protection.

const hardenedDb = new aws.rds.Instance("hardened-postgres", {
    // ...
    backupRetentionPeriod: 35, // Meet 30-day retention + buffer
    copyTagsToSnapshot: true,
    deletionProtection: true,
    skipFinalSnapshot: false,
});

Pitfall Guide

Real-world production experience reveals recurring errors that undermine hardening efforts.

1. Master Credential Leakage: Storing the master password in environment variables or CI/CD logs.
   • Fix: Use a secrets manager (AWS Secrets Manager, HashiCorp Vault) with dynamic secrets or IAM auth. Never commit secrets to code.
2. Overly Permissive Security Groups: Using 0.0.0.0/0 for ingress or referencing public subnets.
   • Fix: Always use Security Group references for ingress. Place DBs in private subnets with NAT-only egress.
3. Ignoring Parameter Group Defaults: Assuming managed services apply secure parameter groups by default.
   • Fix: Explicitly define parameter groups in IaC. Review rds.force_ssl, log_statement, and password_encryption settings.
4. Backup Exposure: Backups inheriting the same access controls as the live database, allowing lateral movement if the backup storage is compromised.
   • Fix: Apply separate IAM policies for backup access. Encrypt backups with a distinct KMS key.
5. Disabling Logging for Performance: Turning off audit logs to reduce IOPS or storage costs.
   • Fix: Benchmark logging overhead; modern engines have minimal impact. Use log sampling for high-throughput environments rather than disabling logs entirely.
6. Static SSL Certificates: Hardcoding SSL certificates in application binaries.
   • Fix: Use OS trust stores or download certificates dynamically. Configure applications to verify the server certificate hostname.
7. Lack of Rotation: Rotating credentials manually or not at all.
   • Fix: Implement automated rotation via Secrets Manager or IAM auth. Test rotation procedures regularly to ensure application resilience.

Production Bundle

Action Checklist

• Enforce TLS 1.2+ and disable older cipher suites via parameter groups.
• Set publiclyAccessible: false and place instances in private subnets.
• Implement IAM Database Authentication for all application connections.
• Enable encryption at rest using a Customer Managed Key with rotation enabled.
• Configure log_connections, log_disconnections, and log_statement in parameter groups.
• Apply Security Groups referencing source SG IDs, never public CIDRs.
• Enable deletion protection and set backup retention to meet compliance (e.g., 35 days).
• Verify audit logs are streamed to a centralized, tamper-proof SIEM.

Decision Matrix

Configuration Template

Copy this Pulumi TypeScript template to provision a hardened PostgreSQL instance on AWS. This template enforces encryption, network isolation, audit logging, and IAM authentication.

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

// 1. KMS Key for Encryption
const dbKey = new aws.kms.Key("db-key", {
    description: "Encryption key for hardened database",
    deletionWindowInDays: 30,
    enableKeyRotation: true,
});

// 2. VPC and Subnets (Assume vpc exists)
// In production, define subnets explicitly in private availability zones.

// 3. Security Group
const dbSg = new aws.ec2.SecurityGroup("db-sg", {
    name: "hardened-db-sg",
    description: "Security group for hardened database",
    vpcId: process.env.VPC_ID,
    ingress: [{
        protocol: "tcp",
        fromPort: 5432,
        toPort: 5432,
        // Replace with your application security group ID
        securityGroups: [process.env.APP_SG_ID], 
    }],
    egress: [{
        protocol: "-1",
        fromPort: 0,
        toPort: 0,
        cidrBlocks: ["0.0.0.0/0"],
    }],
});

// 4. Parameter Group with Audit and Security Settings
const dbParams = new aws.rds.ParameterGroup("db-params", {
    family: "postgres15",
    parameters: [
        { name: "log_connections", value: "1" },
        { name: "log_disconnections", value: "1" },
        { name: "log_statement", value: "ddl" },
        { name: "rds.force_ssl", value: "1" },
        { name: "password_encryption", value: "scram-sha-256" },
    ],
});

// 5. Hardened Database Instance
const db = new aws.rds.Instance("hardened-db", {
    engine: "postgres",
    engineVersion: "15.4",
    instanceClass: "db.t3.medium",
    dbSubnetGroupName: process.env.DB_SUBNET_GROUP,
    vpcSecurityGroupIds: [dbSg.id],
    
    // Security Controls
    storageEncrypted: true,
    kmsKeyId: dbKey.arn,
    publiclyAccessible: false,
    deletionProtection: true,
    
    // Backups
    backupRetentionPeriod: 35,
    copyTagsToSnapshot: true,
    
    // Monitoring
    enabledCloudwatchLogsExports: ["postgresql", "upgrade"],
    performanceInsightsEnabled: true,
    
    // Parameters
    parameterGroupName: dbParams.name,
    
    // IAM Auth
    iamDatabaseAuthenticationEnabled: true,
    
    tags: {
        Environment: "production",
        SecurityHardened: "true",
    },
});

export const dbEndpoint = db.endpoint;
export const dbArn = db.arn;

Quick Start Guide

1. Initialize IaC: Set up a Pulumi or Terraform project. Define your VPC and private subnets if not existing.
2. Apply Template: Copy the configuration template above. Update environment variables (VPC_ID, APP_SG_ID, DB_SUBNET_GROUP) to match your infrastructure. Run pulumi up.
3. Configure Application: Update your application connection string to use IAM authentication. Ensure the application role has rds-db:connect permissions and uses the correct database user mapping.
4. Verify Security: Run a security scan (e.g., Prowler, ScoutSuite) against the provisioned resources. Confirm publiclyAccessible is false, encryption is active, and security groups are restrictive.
5. Enable Monitoring: Set up CloudWatch alarms for DatabaseConnections, CPUUtilization, and specific log patterns indicating unauthorized access attempts. Integrate logs with your SIEM.

Database security hardening is not a one-time task but a continuous discipline enforced by code. By adopting this architecture, organizations reduce risk exposure, ensure compliance, and maintain operational integrity in the face of evolving threats.