> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # RDS Logging Should Be Enabled ### More Info: Ensure RDS logging is enabled ### Risk Level Low ### Address Monitoring ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * DPDPA * Digital Operational Resilience Act (EU) * Essential 8 * GDPR * HIPAA * ISO 27001 * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST SP 800-171 * NYDFS 23 NYCRR 500 * Reserve Bank of India (RBI) Master Direction – Information Technology Framework * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation To remediate the misconfiguration of RDS logging not being enabled in AWS, follow these step-by-step instructions using the AWS Management Console: 1. **Navigate to RDS Console**: * Open the AWS Management Console and navigate to the Amazon RDS service. 2. **Select the RDS Instance**: * From the list of RDS instances, select the instance for which you want to enable logging. 3. **Enable Enhanced Monitoring**: * In the navigation pane, choose "Logs & events" and then select "Enable Enhanced Monitoring". * Choose the monitoring role that you want to associate with this DB instance. * Select the "Enable Enhanced Monitoring" checkbox and choose the monitoring level (0 to 4) that you want to enable. 4. **Enable Performance Insights** (Optional): * If you want to enable Performance Insights for the RDS instance, you can do so by selecting "Enable Performance Insights" in the "Logs & events" section. 5. **Configure Enhanced Monitoring Data Granularity** (Optional): * You can configure the data granularity for Enhanced Monitoring by selecting the "Configure" link next to the monitoring level. 6. **Save Changes**: * Click on the "Apply immediately" button to save the changes and enable logging for the RDS instance. 7. **Verify Logging**: * You can verify that logging has been enabled by checking the logs in the "Logs & events" section of the RDS instance. By following these steps, you will successfully remediate the misconfiguration of RDS logging not being enabled in AWS. # To remediate the misconfiguration of RDS logging not being enabled in AWS using AWS CLI, follow these steps: 1. **Enable RDS Enhanced Monitoring**: Enhanced Monitoring provides detailed visibility into the performance of your RDS instance. You can enable Enhanced Monitoring for your RDS instance by running the following AWS CLI command: ```bash theme={null} aws rds modify-db-instance --db-instance-identifier your-db-instance-name --monitoring-interval 60 --monitoring-role-arn arn:aws:iam::123456789012:role/service-role/AmazonRDSEnhancedMonitoringRole ``` Replace `your-db-instance-name` with the name of your RDS instance and `arn:aws:iam::123456789012:role/service-role/AmazonRDSEnhancedMonitoringRole` with the ARN of the IAM role that enables Enhanced Monitoring. 2. **Enable RDS Performance Insights**: Performance Insights helps you detect performance problems in your RDS instance. You can enable Performance Insights by running the following AWS CLI command: ```bash theme={null} aws rds modify-db-instance --db-instance-identifier your-db-instance-name --enable-performance-insights --performance-insights-retention-period 7 ``` Replace `your-db-instance-name` with the name of your RDS instance and `7` with the desired retention period for Performance Insights data. 3. **Enable RDS Audit Logging**: RDS Audit Logging allows you to capture database activities to help meet compliance requirements. You can enable Audit Logging by running the following AWS CLI command: ```bash theme={null} aws rds modify-db-instance --db-instance-identifier your-db-instance-name --enable-cloudwatch-logs-exports '["audit"]' ``` Replace `your-db-instance-name` with the name of your RDS instance. 4. **Verify the Changes**: After making these changes, verify that RDS logging is enabled by checking the RDS instance configuration: ```bash theme={null} aws rds describe-db-instances --db-instance-identifier your-db-instance-name --query "DBInstances[0].[DBInstanceIdentifier,DBInstanceArn,MonitoringInterval,PerformanceInsightsEnabled,EnabledCloudwatchLogsExports]" --output table ``` Replace `your-db-instance-name` with the name of your RDS instance. By following these steps and using the AWS CLI commands provided, you can remediate the misconfiguration of RDS logging not being enabled in AWS. To remediate the misconfiguration of RDS logging not being enabled in AWS using Python, you can use the AWS SDK for Python (Boto3) to enable logging for your RDS instance. Follow these steps: 1. Install Boto3: ```bash theme={null} pip install boto3 ``` 2. Use the following Python script to enable logging for your RDS instance. Replace `` with the actual identifier of your RDS instance. ```python theme={null} import boto3 # Specify the region where your RDS instance is located region = 'us-east-1' # Specify the identifier of your RDS instance rds_instance_identifier = '' # Create a RDS client rds_client = boto3.client('rds', region_name=region) # Enable logging for the RDS instance response = rds_client.modify_db_instance( DBInstanceIdentifier=rds_instance_identifier, EnableCloudwatchLogsExports=['error', 'general', 'slowquery'] ) # Print the response print(response) ``` 3. Run the Python script. After successful execution, logging should be enabled for your RDS instance. This script will enable logging for the specified RDS instance and export logs to CloudWatch Logs for the error, general, and slow query logs. You can modify the `EnableCloudwatchLogsExports` parameter to customize which logs you want to export. Make sure you have the necessary permissions to modify the RDS instance. ```hcl theme={null} resource "aws_db_instance" "RDS_INSTANCE" { # Replace with your RDS instance settings identifier = "RDS_INSTANCE_IDENTIFIER" # e.g., "prod-app-db" engine = "DB_ENGINE" # e.g., "mysql", "postgres" instance_class = "DB_INSTANCE_CLASS" # e.g., "db.t3.medium" username = "DB_MASTER_USERNAME" password = "DB_MASTER_PASSWORD" allocated_storage = 20 # This enables export of the specified logs to CloudWatch Logs, # matching the CLI remediation's EnableLogTypes. enabled_cloudwatch_logs_exports = [ "audit", "error", "general", "slowquery", ] # Optional: to apply outside the next maintenance window (may cause brief outage) # apply_immediately = true } ``` This change does not force replacement of the DB instance, but it is a modifying operation and may cause a brief outage if `apply_immediately = true` is set. Verification: `terraform plan` should show an in-place update of `aws_db_instance.RDS_INSTANCE` with `enabled_cloudwatch_logs_exports` changing from its current value to `["audit","error","general","slowquery"]`.