More Info:
Ensure RDS logging is enabledRisk Level
LowAddress
MonitoringCompliance Standards
- APRA CPS 234 (Australia)
- BSI C5 (Germany)
- Brazil LGPD
- CCPA / CPRA (California)
- CIS Critical Security Controls v8
- CMMC 2.0
- CSA Cloud Controls Matrix v4
- DPDPA
- Digital Operational Resilience Act (EU)
- Essential 8
- GDPR
- HIPAA
- ISO 27001
- ISO/IEC 27017
- ISO/IEC 27018
- ISO/IEC 27701
- KSA PDPL
- MAS Technology Risk Management (Singapore)
- MITRE ATT&CK (Cloud)
- NIS2 Directive
- NIST SP 800-171
- NYDFS 23 NYCRR 500
- Reserve Bank of India (RBI) Master Direction – Information Technology Framework
- SWIFT Customer Security Controls Framework
- Sarbanes-Oxley IT General Controls
- Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
- UK NCSC Cyber Assessment Framework
Triage and Remediation
- Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration of RDS logging not being enabled in AWS, follow these step-by-step instructions using the AWS Management Console:
-
Navigate to RDS Console:
- Open the AWS Management Console and navigate to the Amazon RDS service.
-
Select the RDS Instance:
- From the list of RDS instances, select the instance for which you want to enable logging.
-
Enable Enhanced Monitoring:
- In the navigation pane, choose “Logs & events” and then select “Enable Enhanced Monitoring”.
- Choose the monitoring role that you want to associate with this DB instance.
- Select the “Enable Enhanced Monitoring” checkbox and choose the monitoring level (0 to 4) that you want to enable.
-
Enable Performance Insights (Optional):
- If you want to enable Performance Insights for the RDS instance, you can do so by selecting “Enable Performance Insights” in the “Logs & events” section.
-
Configure Enhanced Monitoring Data Granularity (Optional):
- You can configure the data granularity for Enhanced Monitoring by selecting the “Configure” link next to the monitoring level.
-
Save Changes:
- Click on the “Apply immediately” button to save the changes and enable logging for the RDS instance.
-
Verify Logging:
- You can verify that logging has been enabled by checking the logs in the “Logs & events” section of the RDS instance.
Using CLI
Using CLI
To remediate the misconfiguration of RDS logging not being enabled in AWS using AWS CLI, follow these steps:Replace Replace Replace Replace
- Enable RDS Enhanced Monitoring: Enhanced Monitoring provides detailed visibility into the performance of your RDS instance. You can enable Enhanced Monitoring for your RDS instance by running the following AWS CLI command:
your-db-instance-name with the name of your RDS instance and arn:aws:iam::123456789012:role/service-role/AmazonRDSEnhancedMonitoringRole with the ARN of the IAM role that enables Enhanced Monitoring.- Enable RDS Performance Insights: Performance Insights helps you detect performance problems in your RDS instance. You can enable Performance Insights by running the following AWS CLI command:
your-db-instance-name with the name of your RDS instance and 7 with the desired retention period for Performance Insights data.- Enable RDS Audit Logging: RDS Audit Logging allows you to capture database activities to help meet compliance requirements. You can enable Audit Logging by running the following AWS CLI command:
your-db-instance-name with the name of your RDS instance.- Verify the Changes: After making these changes, verify that RDS logging is enabled by checking the RDS instance configuration:
your-db-instance-name with the name of your RDS instance.By following these steps and using the AWS CLI commands provided, you can remediate the misconfiguration of RDS logging not being enabled in AWS.Using Python
Using Python
To remediate the misconfiguration of RDS logging not being enabled in AWS using Python, you can use the AWS SDK for Python (Boto3) to enable logging for your RDS instance. Follow these steps:
- Install Boto3:
- Use the following Python script to enable logging for your RDS instance. Replace
<your_rds_instance_identifier>with the actual identifier of your RDS instance.
- Run the Python script. After successful execution, logging should be enabled for your RDS instance.
EnableCloudwatchLogsExports parameter to customize which logs you want to export.Make sure you have the necessary permissions to modify the RDS instance.Using Terraform
Using Terraform
apply_immediately = true is set.Verification: terraform plan should show an in-place update of aws_db_instance.RDS_INSTANCE with enabled_cloudwatch_logs_exports changing from its current value to ["audit","error","general","slowquery"].
