Request to Update the AWS RDS Review Workflow in CSPM
Due to express configuration, a way of creating Aurora clusters without a VPC that AWS introduced in March 2026, we identified that the managed review item "Ensure that RDS instances are deployed in a VPC" (RDS.18) provided by Flatt Security could not judge instances in this configuration correctly.
We have published a workflow that addresses this issue, so please update yours.
This notice concerns the managed reviews for AWS in CSPM. The update described here is not needed for organizations that match any of the following.
- Organizations using only Takumi byGMO
- Organizations not reviewing AWS environments with CSPM
- Organizations that have not registered the workflow "Prebundle: Review AWS RDS posture (FSBP)" described below
Background
In March 2026, AWS introduced express configuration, a way of creating Aurora clusters.
Unlike conventional Aurora clusters, a cluster created with express configuration is not associated with a VPC.
The managed review item "Ensure that RDS instances are deployed in a VPC" (RDS.18) judges VPC membership from the DB subnet group the DB instance refers to. Aurora clusters created with express configuration therefore fall outside this premise and could not be judged correctly.
Anticipating that Aurora clusters in this configuration will come into use, we would appreciate your cooperation in updating this review workflow to prevent incorrect review results.
What to Update
The target of this update is a single job in the following workflow.
| Target | ID | Name |
|---|---|---|
| Workflow | prebundle-aws-fsbp-rds | Prebundle: Review AWS RDS posture (FSBP) |
| Job | instance-vpc | Review instance vpc |
What You Need to Do
The latest GraphQL query and Rego policy are available in the workflows/csp/aws-fsbp/rds/instance-vpc directory of the shisho-cloud-managed-workflows repository. Please replace yours with them.
For reference, "Ensure that RDS instances are deployed in a VPC" (RDS.18) has already been removed from the review items of its source standard, AWS FSBP (AWS Foundational Security Best Practices standard).
Depending on your operational situation, removing the job itself is therefore also an option.
Depending on how you manage your workflows, update through one of the following methods. If the workflow does not appear in your workflow list, no update is needed.
Updating with shishoctl
If you have workflow definitions obtained with shishoctl workflow export, replace the files corresponding to the instance-vpc job (the Rego policy, the GraphQL query, and the test) with the latest contents, and apply them to your organization with shishoctl workflow apply.
Editing in the Console
Open "Prebundle: Review AWS RDS posture (FSBP)" from Workflows, find the job with id: instance-vpc under jobs in the manifest, and replace the contents of rego: in the decide block (the Rego policy) and schema: under input (the GraphQL query) with the published versions, then save.
No changes to other jobs or parameters are needed.
Managing Workflows in a GitHub or GitLab Repository
Replace the three files corresponding to the instance-vpc job (the Rego policy, the GraphQL query, and the test) with the latest contents and push to your main branch.
Your deployment workflow, such as a configured GitHub Actions workflow, applies the changes to Shisho Cloud automatically.
Contact
If you have any questions or concerns about the update, please contact our support desk.
We will assist you according to your situation.