cis-aws-database-7.6

7.6 Ensure Audit Logging is Enabled (Manual)

Description

Enable audit logging to capture database activities, including login attempts, queries, and modifications. Send the logs to Amazon CloudWatch or a centralized log management system for analysis and monitoring.

Rationale

It captures and saves logs of activities that took place in the cluster, by recording login attempts, queries, and any changes within the database.

Impact

Enabling audit logging provides visibility into database activities, helping detect unauthorized access attempts, compliance violations, and security incidents.

Audit Procedure

Using AWS Console

1. Sign into the AWS Management Console

   • Sign into the AWS Management Console at https://console.aws.amazon.com/ with your AWS account credentials.

2. Open the Amazon DocumentDB Console

   • Navigate to the service using the Find Services search bar or by directly accessing the console at https://console.aws.amazon.com/docdb/.

3. Select the DocumentDB Cluster

   • Choose the Amazon DocumentDB cluster for which you want to enable audit logging.
   • Click on the cluster name to access its details page.
   • In the cluster details page, navigate to the "Configuration" section.

4. Enable Audit Logging

   • Under the Database options or Database features section.
   • Click on the Edit button or Modify option to configure the audit logging settings.
   • Enable the option for audit logging by choosing the appropriate setting.
   • Specify the destination for the audit logs, which can be an Amazon CloudWatch Logs group or an Amazon S3 bucket.

5. Configure Audit Log Destination

   • If you choose to send audit logs to an Amazon CloudWatch Logs group, select the existing group or create a new one.
   • If you choose to send audit logs to an Amazon S3 bucket, select the existing bucket or create a new one. Provide the necessary permissions for DocumentDB to write logs to the bucket.

6. Set Audit Log Retention Period

   • Specify the retention period for the audit logs, indicating how long the logs should be retained in the selected destination.
   • Consider your compliance and regulatory requirements when determining the retention period.

7. Save the Configuration

   • Click on the Save button to apply the audit logging configuration. DocumentDB will start recording audit logs according to the configured settings.

8. Validate Audit Logging

   • Perform operations on your DocumentDB cluster to generate audit log events.
   • Verify that the audit logs are recorded and sent to the specified destination.
   • Review the logs to ensure they contain the expected information and events.

9. Monitor and Analyze Audit Logs

   • Use Amazon CloudWatch Logs or other log analysis tools to monitor and analyze the audit logs generated by DocumentDB.
   • Set up log metrics, alarms, and notifications to detect unusual activities or security incidents.
   • Review audit logs regularly to identify potential security threats, compliance violations, or unauthorized access attempts.

Expected Result

Audit logging is enabled for all DocumentDB clusters with logs being sent to CloudWatch Logs or S3, with appropriate retention periods configured.

Remediation

Using AWS Console

Follow the audit procedure steps to enable audit logging for each DocumentDB cluster. Configure the cluster parameter group to enable audit logging by setting audit_logs to enabled.

Default Value

Audit logging is not enabled by default for Amazon DocumentDB.

References

1. https://aws.amazon.com/products/databases/

CIS Controls

Profile

Level 1 | Manual