Microsoft Defender for Cloud
Cloud and workloadsVerify protection for open-source relational databases on AWS
In brief
The article now adds checks for the Databases plan and AWS connector health, lists supported database engines and deployment configurations, and provides linked error tables and troubleshooting scenarios.
What Defender admins need to know
Administrators can use the added checks and tables to verify coverage and resolve protection issues.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Verify protection for open-source relational databases on AWS
Verify plan enablement
To verify that the Databases plan is enabled for the AWS connector:
In the Azure portal, go to Microsoft Defender for Cloud.
Go to Environment settings.
Verify connector health
To verify that the AWS connector is healthy:
In Defender for Cloud, go to Environment settings.
Select the AWS connector.
Verify resource support
Defender for Cloud protection appliesprotects only to supportedcertain database engines and configurations. Check the following tables to confirm that your resources are supported.
Supported database engines
The following table lists the database engines that Defender for Cloud supports on AWS.
| Engine | Supported |
|---|---|
| PostgreSQL | Yes |
Supported configurations
The following table lists the supported deployment configurations and any important notes.
| Configuration | Supported | Notes |
|---|---|---|
| Single-AZ | Yes | Standard deployment. |
The recommendation The status of open-source relational databases on AWS RDS should be protected lists resources that aren't fully protected. Each unhealthy resource includes a reason that explains what needs to be fixed.
Use the followingOpen-source relational database protection errors and Sensitive data discovery errors tables to review the reason and recommended action.
Open-source relational database protection errors
The following table lists common protection errors, what they mean, and how to resolve them.
| Unhealthy reason | Description | Recommended action |
|---|---|---|
| Defender for open-source relational databases isn't authorized | Defender for open-source relational databases isn't authorized because the onboarding configuration is incomplete. This can happen if the role's web identity configuration is missing the required service identity, the OpenID Connect (OIDC) provider is missing, or an explicit deny or missing permission is blocking the required action. | Rerun the AWS CloudFormation template for the connector and follow the AWS onboarding troubleshooting guide to complete onboarding. |
Common verification results
The following scenarios describe common results you might see during verification and how to resolve them.
The plan is enabled, but the resource shows as not applicable or has no data
Verify that the resource uses a supported engine, configuration, and region. Then verify that the AWS connector is healthy and that one full discovery cycle completed.
@@ -3,8 +3,9 @@ title: Verify protection for open-source relational databases on AWS description: Learn how to verify that Microsoft Defender for Cloud is configured to protect open-source relational databases on Amazon RDS and Aurora. ms.service: defender-for-cloud ms.topic: how-to-ms.date: 05/27/2026+ms.date: 07/03/2026 ai-usage: ai-assisted+ms.custom: msecd-doc-authoring-1013 --- # Verify protection for open-source relational databases on AWS@@ -15,6 +16,8 @@ Use this article to check plan enablement, connector health, regional configurat ## Verify plan enablement +To verify that the Databases plan is enabled for the AWS connector:+ 1. In the Azure portal, go to **Microsoft Defender for Cloud**. 1. Go to **Environment settings**.@@ -29,6 +32,8 @@ If the plan or component is turned off, turn it on and save the connector config ## Verify connector health +To verify that the AWS connector is healthy:+ 1. In Defender for Cloud, go to **Environment settings**. 1. Select the AWS connector.@@ -68,10 +73,12 @@ If a supported resource doesn't appear after one full discovery cycle, verify th ## Verify resource support -Defender for Cloud protection applies only to supported database engines and configurations.+Defender for Cloud protects only certain database engines and configurations. Check the following tables to confirm that your resources are supported. ### Supported database engines +The following table lists the database engines that Defender for Cloud supports on AWS.+ | Engine | Supported | |---|---| | PostgreSQL | Yes |@@ -84,6 +91,8 @@ Defender for Cloud protection applies only to supported database engines and con ### Supported configurations +The following table lists the supported deployment configurations and any important notes.+ | Configuration | Supported | Notes | |---|---|---| | Single-AZ | Yes | Standard deployment. |@@ -97,10 +106,12 @@ If the database engine, region, or configuration isn't supported, Defender for C The recommendation **The status of open-source relational databases on AWS RDS should be protected** lists resources that aren't fully protected. Each unhealthy resource includes a reason that explains what needs to be fixed. -Use the following tables to review the reason and recommended action.+Use the [Open-source relational database protection errors](#open-source-relational-database-protection-errors) and [Sensitive data discovery errors](#sensitive-data-discovery-errors) tables to review the reason and recommended action. ### Open-source relational database protection errors +The following table lists common protection errors, what they mean, and how to resolve them.+ | Unhealthy reason | Description | Recommended action | |---|---|---| | **Defender for open-source relational databases isn't authorized** | Defender for open-source relational databases isn't authorized because the onboarding configuration is incomplete. This can happen if the role's web identity configuration is missing the required service identity, the OpenID Connect (OIDC) provider is missing, or an explicit deny or missing permission is blocking the required action. | Rerun the AWS CloudFormation template for the connector and follow the [AWS onboarding troubleshooting guide](quickstart-onboard-aws.md?tabs=Defender-for-SQL) to complete onboarding. |@@ -126,6 +137,8 @@ Sensitive data discovery for Amazon RDS is also available through Defender CSPM. ## Common verification results +The following scenarios describe common results you might see during verification and how to resolve them.+ ### The plan is enabled, but the resource shows as not applicable or has no data Verify that the resource uses a supported engine, configuration, and region. Then verify that the AWS connector is healthy and that one full discovery cycle completed.