Skip to content
TheCloud.Events

AuthorizeDBSecurityGroupIngress

AWS

AuthorizeDBSecurityGroupIngress

service: AWS - RDS
tactics:
Defense Impairment
techniques:
T1686.001
tags:
AWS RDS

Event

Adds inbound rules to an RDS DB security group, allowing specified IP ranges or EC2 security groups to access the database.

Security Context

  • Modifying network security controls can open unauthorized access paths while removing evidence of the original restrictive configuration.

Log Source

CloudTrail

Sample Event

Adversarial. Draco — having compromised a session with rds:AuthorizeDBSecurityGroupIngress — opens a legacy DB security group that fronts a NIFFLER analytics RDS instance to 0.0.0.0/0. Goal is to enable later credential-stuffing or direct exfil from outside the VPC perimeter. He targets a legacy non-VPC DB SG (niffler-analytics-default) because those still exist in long-running accounts and frequently lack modern network segmentation alarms.

{
  "eventVersion": "1.09",
  "userIdentity": {
    "type": "IAMUser",
    "principalId": "AIDADRAC0MALF0YBADGY",
    "arn": "arn:aws:iam::555123456789:user/draco",
    "accountId": "555123456789",
    "accessKeyId": "AKIADRAC0MALF0YEXAMP5",
    "userName": "draco",
    "sessionContext": {
      "attributes": {
        "creationDate": "2026-04-15T18:51:02Z",
        "mfaAuthenticated": "false"
      }
    }
  },
  "eventTime": "2026-04-15T21:02:48Z",
  "eventSource": "rds.amazonaws.com",
  "eventName": "AuthorizeDBSecurityGroupIngress",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "203.0.113.66",
  "userAgent": "aws-cli/1.18.147 Python/3.7.10 Linux/5.4.0-1045-aws botocore/1.18.6",
  "requestParameters": {
    "dBSecurityGroupName": "niffler-analytics-default",
    "cIDRIP": "0.0.0.0/0"
  },
  "responseElements": {
    "dBSecurityGroup": {
      "ownerId": "555123456789",
      "dBSecurityGroupName": "niffler-analytics-default",
      "dBSecurityGroupDescription": "default",
      "iPRanges": [
        {
          "status": "authorizing",
          "cIDRIP": "0.0.0.0/0"
        }
      ],
      "eC2SecurityGroups": []
    }
  },
  "requestID": "90000000-0000-4000-8000-000001110110",
  "eventID": "90000000-0000-4000-8000-000001110111",
  "readOnly": false,
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "555123456789",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "rds.us-east-1.amazonaws.com"
  }
}

MITRE ATT&CK Mapping

Tactics: Defense Impairment

Techniques:
  • T1686.001 — Cloud Firewall — Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources.
shares T1686.001 — Cloud Firewall
AuthorizeSecurityGroupEgress AuthorizeSecurityGroupIngress compute.firewalls.delete compute.firewalls.patch CreateNetworkAclEntry DeleteNetworkAcl DeleteNetworkAclEntry Microsoft.Network/networkSecurityGroups/delete +1 more
same service (AWS - RDS)
CreateDBSnapshot DeleteDBCluster DeleteDBInstance DeleteGlobalCluster ModifyDBInstance ModifyDBSnapshotAttribute RestoreDBInstanceFromDBSnapshot StartExportTask