Direct answer
A database's public endpoint setting is one part of exposure. Assess addressing, routes, firewall rules and authentication together, and distinguish a configured endpoint from a demonstrated reachable path.
Identify the database and clients
Record the service, account, region, database owner, endpoint, required application clients and maintenance paths. Agree a non-production instance or harmless test endpoint; do not extract real data to prove network reachability.
Reference: AWS: Working with Amazon RDS DB instances in a VPC.
Review network and identity
Compare public-address settings, subnet routes and security rules with the intended design. Check database accounts, administrative access, encryption and monitoring as separate controls. A reachable port does not establish that an unauthenticated person can read data.
- Inventory approved source networks.
- Record both public and private access paths.
- Plan recovery before changing management connectivity.
Test representative sources
From authorized approved and prohibited test locations, perform a harmless connection check and record source, destination, time and result. Where login testing is authorized, use dedicated low-privilege accounts and known synthetic data.
For example, compare a connection from an approved application subnet with a separate test host outside that boundary. A timeout may result from routing, filtering or an unavailable database; document it as inconclusive until the owner can distinguish those causes. Do not use a failed login as the only test of the network boundary.
Restrict and retest
Use the owner's change process to narrow unnecessary paths, verify legitimate application and backup access, then repeat both source tests. Document any pending exception with an owner and review date.
Assessment limits
A connectivity check from one location cannot establish global exposure or database security. Managed service behavior and responsibility differ by provider and deployment.
Frequently asked questions
Does a public endpoint always mean anyone can read the database?
No. Network reachability and database authentication are separate questions, though unnecessary exposure can increase risk.
Is a failed connection proof the endpoint is private?
No. The source path or service may be unavailable. Test the intended paths and review configuration.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.