AWS RDS Audit - Security Checks
Checks Performed
- Accessibility Should Be Well-defined in Aurora Clusters
- Amazon Backup Should Be Integrated with Amazon RDS
- Aurora DB Clusters Should Be Protected By Backup Plan
- Aurora DB Clusters Should Have Recovery Point
- Aurora DB Clusters Should Have Recovery Point Within Specified Duration
- Auto Minor Version Upgrade flag Should Be Enabled
- Automated Backups Should Be Enabled
- AWS Deprecated RDS Versions Should Not Be Used
- Backtrack Feature Should Be Enabled
- Backup Retention Duration Should Be Present
- Cluster Deletion Protection Should Be Enabled
- Database Migration Service Endpoints Should Have SSL Configuration
- DMS Replication Auto Minor Version Upgrade Should Be Enabled
- DMS Replication Should Not Be Public
- DMS Replication Task Source DB Should Have Logging Enabled
- DMS Replication Task Target DB Should Have Logging Enabled
- DocDB Cluster Audit Logging Should Be Enabled
- Document DB Cluster Should Have Backup Retention Check
- DocumentDB Cluster Should Have Deletion Protection Enabled
- DocumentDB Clusters Should Be Encrypted
- DocumentDB Custer Snapshots Should Not Be Public
- Encryption Should Be Enabled For Amazon Athena Group
- Enhanced Monitoring Should Be Enabled For RDS Instances
- Event Notification Subscriptions Should Be Enabled
- Event Notifications Should Be Enabled
- General Purpose SSDs Should Be Used Instead of IOPS SSDs
- IAM DB authentication Should Be Enabled
- Instance Deletion Protection Should Be Enabled
- Log Exports Should Be Enabled
- Master Username Should Be Unique
- MSK Cluster Encryption In Transit Should Be Enabled
- Multi-AZ Deployment Should Be Used
- MySQL Aurora Logs Should Be Enabled
- Neptune Cluster Has IAM Database Authentication Should Be Enabled
- Neptune Cluster Should Have CloudWatch Log Exports Enabled
- Neptune Cluster Should Have Copy Tags For Snapshots Enabled
- Neptune Clusters Snapshots Should Encrypted
- Neptune DB Cluster Should Have Backup Retention Check
- Neptune DB Cluster Should Have Deletion Protection Enabled
- Neptune DB Cluster Snapshot Should Not Be Public
- Neptune DB Clusters Storage Encryption Should Be Enabled
- Performance Insights Feature Should Be Enabled
- RDS Cluster Parameter Groups Pending Reboot
- RDS Database Instances Should Not Use Default Ports
- RDS Database Snapshots Should Not Be Public
- RDS Databases Should Have Free Storage Space
- RDS DB Instances Should Not Be Provisioned in VPC Public Subnets
- RDS Instance Count Should Not Exceed Limit
- RDS Instance Should Be Of Desired Type
- RDS Instances Should Have Encryption Enabled
- RDS Instances Should Make Use Of Copy Tags
- RDS Instances Should Not Allow Unrestricted In/Outbound Access
- RDS instances Should Not Be Idle
- RDS Instances Should Not Be Overutilized
- RDS Instances Should Not Be Publicly Accessible
- RDS Instances Should Not Be Underutilized
- RDS Instances Should Use Latest Generation of Instance Classes
- RDS Logging Should Be Enabled
- RDS Reserved Instances Purchases Should Be Reviewed Every 7 Days
- RDS Reserved Instances Should Not Have Status - Payment Failed
- RDS Reserved Instances Should Not Have Status - Payment Pending
- RDS RIs Should Have A Corresponding DB Instances
- RDS Should Have Backup Recovery Point Created
- Renew RDS Reserved Instances Before Expiration (30 days)
- Renew RDS Reserved Instances Before Expiration (7 days)
- Security Groups Events Subscriptions Should Be Enabled
- Serverless Log Exports Should Be Enabled
- Should Use Customer-Managed Keys Instead Of AWS-managed Keys
- Snapshot Encryption Feature Should Be Enabled
- Transport Encryption Feature Should Be Enabled