It's possible to give public access to the database from the internet. The attacker will still need to know the username and password, IAM access, or an exploit to enter in the database.
Public RDS Snapshots
AWS allows giving access to anyone to download RDS snapshots. You can list these public RDS snapshots very easily from your own account:
# Public RDS snapshotsawsrdsdescribe-db-snapshots--include-public## Search by account IDaws rds describe-db-snapshots --include-public --query 'DBSnapshots[?contains(DBSnapshotIdentifier, `284546856933:`) == `true`]'
## To share a RDS snapshot with everybody the RDS DB cannot be encrypted (so the snapshot won't be encryted)## To share a RDS encrypted snapshot you need to share the KMS key also with the account# From the own account you can check if there is any public snapshot with:awsrdsdescribe-db-snapshots--snapshot-typepublic [--region us-west-2]## Even if in the console appear as there are public snapshot it might be public## snapshots from other accounts used by the current account
