Skip to main content

More Info:

Checks if enhanced monitoring is enabled for Amazon RDS instances. This rule is NON_COMPLIANT if monitoringInterval is 0 in the configuration item of the RDS instance, or if monitoringInterval does not match the rule parameter value.

Risk Level

Medium

Address

Monitoring

Compliance Standards

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • Reserve Bank of India (RBI) Master Direction – Information Technology Framework
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
  • UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Using Console

To remediate the misconfiguration of not having Enhanced Monitoring enabled for RDS instances in AWS using the AWS Management Console, follow these step-by-step instructions:
  1. Login to AWS Console: Go to the AWS Management Console (https://aws.amazon.com/console/) and login using your credentials.
  2. Navigate to RDS Service: Click on the “Services” dropdown in the top left corner of the console, then select “RDS” under the “Database” category.
  3. Select RDS Instance: In the Amazon RDS dashboard, select the RDS instance for which you want to enable Enhanced Monitoring.
  4. Enable Enhanced Monitoring: Click on the RDS instance name to open the details page. In the navigation pane on the left, click on “Configuration” to expand the configuration options.
  5. Modify Instance: Click on the “Modify” button at the top of the page to modify the instance settings.
  6. Enable Enhanced Monitoring: Scroll down to the “Monitoring” section of the Modify DB Instance page. Look for the “Enhanced monitoring” option and select the desired monitoring level (e.g., Basic, Enhanced, or Performance Insights).
  7. Save Changes: Scroll to the bottom of the page and click on the “Continue” button. Review the changes you are about to make, and then click on the “Modify DB Instance” button to apply the changes.
  8. Monitor Status: Once the modification is complete, the status of the RDS instance will change to “modifying.” You can monitor the progress of the modification in the RDS console.
  9. Verify Enhanced Monitoring: After the modification is completed, go back to the RDS instance details page and check the monitoring section to ensure that Enhanced Monitoring is enabled for the instance.
By following these steps, you will successfully remediate the misconfiguration of not having Enhanced Monitoring enabled for RDS instances in AWS using the AWS Management Console.

To remediate the misconfiguration of not having Enhanced Monitoring enabled for RDS instances in AWS using AWS CLI, you can follow these steps:Step 1: List all the RDS instances in your AWS account:
Step 2: Identify the RDS instance for which you want to enable Enhanced Monitoring.Step 3: Enable Enhanced Monitoring for the identified RDS instance:
Replace YOUR_DB_INSTANCE_IDENTIFIER with the actual identifier of your RDS instance.Step 4: Verify that Enhanced Monitoring is enabled for the RDS instance:
After following these steps, Enhanced Monitoring should be successfully enabled for the specified RDS instance in AWS using AWS CLI.
To remediate the misconfiguration of not having Enhanced Monitoring enabled for AWS RDS instances using Python, you can use the AWS SDK for Python (Boto3) to enable Enhanced Monitoring. Here are the step-by-step instructions to remediate this issue:
  1. Install Boto3: If you haven’t already installed the Boto3 library, you can do so using pip:
  2. Configure AWS Credentials: Ensure that you have configured your AWS credentials either by setting environment variables or using the AWS CLI aws configure command.
  3. Write a Python script: Create a Python script with the following code to enable Enhanced Monitoring for your RDS instance:
  4. Replace the placeholders:
    • Replace 'your_rds_instance_identifier' with the actual RDS instance identifier for which you want to enable Enhanced Monitoring.
    • Replace 'arn:aws:iam::123456789012:role/monitoringRole' with the ARN of the IAM role that has permissions to publish monitoring data to CloudWatch.
  5. Run the Python script: Execute the Python script in your terminal or IDE to enable Enhanced Monitoring for the specified RDS instance. Make sure to review the output for any errors.
By following these steps and running the Python script, you can remediate the misconfiguration of not having Enhanced Monitoring enabled for AWS RDS instances.
Changing monitoring_interval and monitoring_role_arn does not force replacement of the DB instance, but AWS may reboot the instance if there are other pending modifications; review pending changes before applying.To verify, terraform plan should show:
  • aws_iam_role.rds_monitoring_role and aws_iam_role_policy_attachment.rds_monitoring_role_attach being created (if not already managed), and
  • aws_db_instance.rds_instance updated in-place with monitoring_interval = 60 and the specified monitoring_role_arn.

Additional Reading: