Cis AWS Database 2.5

2.5 Ensure Database Audit Logging is Enabled (Manual)

Description

Amazon Aurora provides advanced auditing capabilities through AWS CloudTrail and Amazon RDS Database Activity Streams. Here is a step-by-step guide on how to enable and use these features:

Rationale

Allows individuals to access and retrieve their old logs, log their new events, and store their log.

Impact

Without audit logging enabled, it becomes difficult to track database access, detect unauthorized activities, and meet compliance requirements.

Audit Procedure

Using AWS Console

Enabling logging through AWS CloudTrail:

1. Sign in to AWS Management Console

   • If you do not already have an AWS account, you will need to create one at https://aws.amazon.com.

2. Navigate to CloudTrail Dashboard

   • Navigate to the CloudTrail service.
   • You can find this under the Management & Governance category.

3. Create a new trail

   • In the CloudTrail Dashboard, click on Create trail.
   • Provide a name for the trail, and specify the S3 bucket where you want the logs to be stored.

4. Configure trail settings

   • Choose the settings that meet your requirements. For instance, you can log events for all regions, or you can log management events, data events, or both.

5. Create the trail

   • After specifying the trail settings, click Create.

Enabling logging through Amazon Database Activity Streams:

1. Navigate to Amazon RDS Dashboard

   • In the AWS Management Console, navigate to the RDS service.
   • You can find this under the Database category.

2. Choose your Aurora DB instance

   • In the RDS Dashboard, click on Databases, and then click on the name of your Aurora DB instance.

3. Enable Database Activity Streams

   • In the Connectivity & Security tab, find the Database Activity Streams section. Click Create stream.
   • In the Create Stream panel, choose the settings that meet your requirements and click Create.

Note: Enabling Database Activity Streams can impact the performance of your DB instance, so you should test this feature in a non-production environment before enabling it in production.

4. View the Database Activity Stream
   • You can view the Database Activity Stream using Amazon Kinesis Data Streams.
   • In the Kinesis Data Streams dashboard, click on the stream's name and then click View data.

Expected Result

• A CloudTrail trail should be configured to log Aurora/RDS API events.
• Database Activity Streams should be enabled for Aurora clusters requiring detailed database-level audit logging.

Remediation

Follow the audit procedure steps above to enable CloudTrail logging and/or Database Activity Streams for Aurora clusters.

Default Value

CloudTrail logs management events by default, but a trail must be created to store and retain logs. Database Activity Streams are not enabled by default.

References

1. https://aws.amazon.com/products/databases/

CIS Controls

Profile

Level 1 | Manual