← all rules
iac/terraform/tf-rds-publicly-accessible
Database is publicly accessible
highTerraformiac-terraform
What it detects
`publicly_accessible = true` gives an RDS instance a public endpoint. Databases should sit in private subnets reachable only from application security groups, never directly from the internet.
Remediation
Set `publicly_accessible = false` and reach the database through a bastion, VPN, or private application tier.
How it runs
Detection layer not documented.
Found a false positive or want this rule tuned? File an issue. You can also suppress per-repo via a .repoguardignore line.