# AWS - RDS Unauthenticated Enum

{{#include ../../../banners/hacktricks-training.md}}

## RDS

For more information check:

{{#ref}}
../aws-services/aws-relational-database-rds-enum.md
{{#endref}}

## Public Port

It's possible to give public access to the **database from the internet**. The attacker will still need to **know the username and password,** IAM access, or an **exploit** to enter in the database.

## Public RDS Snapshots

AWS allows giving **access to anyone to download RDS snapshots**. You can list these public RDS snapshots very easily from your own account:

```bash
# Public RDS snapshots
aws rds describe-db-snapshots --include-public

## Search by account ID
aws rds describe-db-snapshots --include-public --query 'DBSnapshots[?contains(DBSnapshotIdentifier, `284546856933:`) == `true`]'
## To share a RDS snapshot with everybody the RDS DB cannot be encrypted (so the snapshot won't be encryted)
## To share a RDS encrypted snapshot you need to share the KMS key also with the account


# From the own account you can check if there is any public snapshot with:
aws rds describe-db-snapshots --snapshot-type public [--region us-west-2]
## Even if in the console appear as there are public snapshot it might be public
## snapshots from other accounts used by the current account
```

### Public URL template

```
mysql://{user_provided}.{random_id}.{region}.rds.amazonaws.com:3306
postgres://{user_provided}.{random_id}.{region}.rds.amazonaws.com:5432
```

{{#include ../../../banners/hacktricks-training.md}}