AWS RDS Database Security Group Modification
Detects changes to the security group entries for AWS RDS databases. This can indicate a misconfiguration that potentially exposes the database to the public internet, a wider audience within the VPC, or the removal of valid rules which could impact database availability for legitimate services and users. The rule specifically looks for API calls related to authorizing, creating, deleting, or revoking database security group ingress rules.
Sigma
