Need your AWS lab account? Go to the self-service login →
AWS Partner
Varonis Systems · Proprietary & Confidential

Lab 6 · Publicly Exposed Database

A database full of sensitive rows, reachable from the internet, with an over-privileged user. Fix the network exposure in the console with DAC as your guide.

Scenario tie-in
Aurora opened to 0.0.0.0/0 on 3306/5432, a DB user granted superuser, weak varonis/password.

6.1 Investigate

  1. Data Stores → RDS → sensitive instances; drill to Table/Columns → Compliance.
  2. Access tab: public exposure + over-privileged users.

6.2 Remediate (console)

  1. RDS → instance → security group → remove 0.0.0.0/0 on 3306/5432.
  2. Set Publicly accessible = No.
  3. Revoke superuser; disable weak varonis account.
Order of operations
Close the network exposure first, then fix in-database grants.
Done when
The database is no longer internet-reachable, the DB user is right-sized, and DAC reflects it.