cis-aws-database-4.6

4.6 Ensure DynamoDB Streams and AWS Lambda for Automated Compliance Checking is Enabled

Description

Enabling DynamoDB Streams and integrating AWS Lambda allows you to automate compliance checking and perform actions based on changes made to your DynamoDB data.

Rationale

Enabling the DynamoDB with AWS Lambda allows the individual to either use an existing or create a new execution role that allows Lambda to access DynamoDB and write logs.

Impact

N/A

Audit Procedure

Using AWS Console

1. Open DynamoDB Console

   • Sign in to the AWS Management Console and open the DynamoDB console at https://console.aws.amazon.com/dynamodb/.

2. Create or Select a DynamoDB Table

   • You can create a new DynamoDB table or select an existing one to enable DynamoDB Streams.

3. Enable DynamoDB Streams

   • In the DynamoDB console, select your table.
   • Click on the Overview tab.
   • Under the DynamoDB Streams section, click on Manage stream.
   • In the Manage stream dialog, choose Enable and select the desired view type (e.g., New and old images).
   • Click Enable.

4. Create an AWS Lambda Function

   • Open the AWS Management Console and navigate to the Lambda service at https://console.aws.amazon.com/lambda/.
   • Click Create function to create a new Lambda function.
   • Choose a function name, runtime (e.g., Node.js, Python), and other basic settings.
   • Under Permissions, choose an existing or create a new execution role that allows Lambda to access DynamoDB and write logs.
   • Click Create function to create the Lambda function.

5. Configure AWS Lambda with DynamoDB Stream

   • Scroll down to the Designer section in the Lambda function editor.
   • Click on Add trigger.
   • Select DynamoDB from the trigger list.
   • In the Configure triggers dialog, choose the DynamoDB table and the stream that you enabled in the previous step.
   • Define the batch size and starting position, if applicable.
   • Click "Add".

6. Write Lambda Function Code for Compliance Checking

   • In the Lambda function editor, scroll up to the code editor section.
   • Write your compliance-checking logic in the selected runtime language (e.g., Node.js, Python).
   • The code should handle the incoming DynamoDB stream records and perform the necessary compliance checks.
   • If needed, you can use the AWS SDKs or other libraries to interact with DynamoDB or other AWS services.

7. Configure Lambda Function Settings

   • Scroll down to the Function overview section.
   • Configure the memory, timeout, and other settings as per your requirements.
   • Click Save to save the Lambda function.

8. Test the Compliance Checking

   • You can test the compliance checking by changing the DynamoDB table and observing the Lambda function's behavior through the CloudWatch logs or other desired actions performed by the function.

Expected Result

DynamoDB Streams are enabled and an AWS Lambda function is configured to process stream records for automated compliance checking.

Remediation

Using AWS Console

Follow the same steps as the audit procedure to enable DynamoDB Streams and create a Lambda function for automated compliance checking.

Default Value

By default, DynamoDB Streams are not enabled and no Lambda triggers are configured.

References

1. https://aws.amazon.com/products/databases/

CIS Controls

Profile

Level 1 | Manual