# Cis AWS Database 6.4

> Cis AWS Database 6.4 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Ensure Audit Logging is Enabled

- Skill name: `cis-aws-database-6.4`
- Category: [DevOps & Security](https://www.openparable.com/skill/devops-security/1)
- Source: https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Cloud_Providers/AWS/CIS_AWS_Database_Services_Benchmark_v2.0.0/cis-aws-database-6.4/SKILL.md
- Repository: CyberStrikeus/CyberStrike (1,211 GitHub stars when collected)

## SKILL.md

# 6.4 Ensure Audit Logging is Enabled (Manual)

## Description

Enabling audit logging on Amazon MemoryDB allows you to capture and store logs of activities performed on your clusters.

## Rationale

It captures and saves logs of activities that took place in the cluster.

## Impact

Reduces risks of any fraud since worker activity is being monitored and tracked.

## Audit Procedure

### Using AWS Console

1. Sign into the AWS Management Console
   - Sign into the AWS Management Console at https://console.aws.amazon.com/ with your AWS account credentials.

2. Open the Amazon MemoryDB Console
   - Navigate to the service using the `Find Services` search bar or by directly accessing the console at https://console.aws.amazon.com/memorydb/.

3. Select the Cluster
   - Choose the MemoryDB cluster for which you want to enable audit logging. Click on the cluster name to access its details page.

4. Enable Amazon CloudWatch Logs
   - In the cluster details page, navigate to the `Logging` section.
   - Click on `Modify` to edit the logging settings.
   - Select the option to enable CloudWatch Logs.
   - Choose an existing CloudWatch log group or create a new one to store the logs generated by the MemoryDB cluster activities.
   - Optionally, you can specify a log retention period to define how long the logs will be stored.
   - Click `Apply Changes` to enable CloudWatch Logs for the MemoryDB cluster.

5. Configure CloudWatch Logs
   - Open the CloudWatch console by navigating to `CloudWatch` in the AWS Management Console.
   - In the left-side menu, click on `Logs`.
   - Create a new log group or select an existing log group that will store the MemoryDB logs.
   - Configure log retention settings based on your retention requirements. Logs can be stored for a specific number of days or indefinitely.
   - Define any necessary log group permissions to control access to the logs.
   - Optionally, set up log exports or alarms for specific log events or patterns if needed.

6. Verify Logging Status
   - Wait a few minutes for the changes to propagate and the logging configuration to take effect.
   - Refresh the cluster details page to see the updated logging status.
   - Verify that CloudWatch Logs is enabled for the MemoryDB cluster.

7. Monitor and Analyze Logs
   - Navigate to the CloudWatch console and select the log group that stores the MemoryDB logs.
   - Monitor the logs to gain insights into the activities and operations performed on your MemoryDB cluster.
   - Use CloudWatch Logs features, such as log searching, filtering, and visualization, to analyze the logs and identify any security or operational issues.
   - Establish appropriate log monitoring and alerting mechanisms to proactively identify and respond to potential security incidents or operational anomalies.

## Expected Result

CloudWatch Logs is enabled for all MemoryDB clusters with appropriate log groups and retention periods configured.

## Remediation

### Using AWS Console

Follow the audit procedure steps to enable CloudWatch Logs for each MemoryDB cluster and configure appropriate log retention and monitoring.

## Default Value

Audit logging is not enabled by default for Amazon MemoryDB for Redis.

## References

1. https://aws.amazon.com/products/databases/

## CIS Controls

| Controls Version | Control                                                    | IG 1 | IG 2 | IG 3 |
| ---------------- | ---------------------------------------------------------- | ---- | ---- | ---- |
| v8               | 8.1 Establish and Maintain an Audit Log Management Process | X    | X    | X    |
| v7               | 6.2 Activate audit logging                                 | X    | X    | X    |

## Profile

Level 1 | Manual

---

Source: https://www.openparable.com/skill/devops-security/cis-aws-database-6-4 (OpenParable). Cite the canonical URL above.