Skip to main content

Triage and Remediation

Remediation

Using Console

To remediate the misconfiguration of log exports not being enabled for an AWS RDS instance, you can follow these steps using the AWS Management Console:
  1. Login to AWS Console: Go to the AWS Management Console (https://aws.amazon.com/console/) and log in to your account.
  2. Navigate to RDS Service: Click on the “Services” dropdown menu at the top left corner of the console. Under the “Database” section, click on “RDS” to open the Amazon Relational Database Service dashboard.
  3. Select the RDS Instance: From the list of RDS instances, select the instance for which you want to enable log exports by clicking on its name.
  4. Enable Enhanced Monitoring: In the RDS instance dashboard, scroll down to the “Logs & events” section. Click on the “Modify” button.
  5. Enable Log Exports: In the “Modify DB instance” page, scroll down to the “Monitoring & logging” section. Check the box next to “Enhanced monitoring” to enable it.
  6. Configure Log Exports: Under the “Enhanced monitoring” section, you can configure the log types that you want to export. Select the log types (e.g., slow query logs, audit logs) that you want to export.
  7. Save Changes: Scroll down to the bottom of the page and click on the “Continue” button. Review the changes you have made, and click on the “Modify DB instance” button to save the changes.
  8. Verify Log Exports: Once the changes are saved, AWS will start exporting the selected logs from your RDS instance. You can verify the log exports by checking the log destination you have configured (e.g., CloudWatch Logs).
By following these steps, you have successfully remediated the misconfiguration of log exports not being enabled for your AWS RDS instance.

To remediate the misconfiguration of enabling log exports for AWS RDS using AWS CLI, follow these step-by-step instructions:
  1. Enable Enhanced Logging: First, enable Enhanced Logging for your RDS instance. This will allow you to export the logs to CloudWatch Logs.
    Replace YOUR_DB_INSTANCE_IDENTIFIER with the identifier of your RDS instance, YOUR_CLOUDWATCH_ROLE_ARN with the ARN of the IAM role that has permission to write logs to CloudWatch Logs, and YOUR_INTERVAL with the interval at which logs should be sent to CloudWatch Logs.
  2. Configure Log Exports: Next, configure the log exports for your RDS instance. You can specify which logs you want to export (error, slow query, general logs, etc.).
    Replace YOUR_DB_INSTANCE_IDENTIFIER with the identifier of your RDS instance. In the EnableLogTypes array, specify the types of logs you want to export.
  3. Verify Configuration: You can verify that the log exports are enabled for your RDS instance by describing the instance.
    This command will provide detailed information about your RDS instance, including the log export configuration.
By following these steps, you can remediate the misconfiguration of enabling log exports for your AWS RDS instance using AWS CLI.
To enable log exports for AWS RDS using Python, you can use the AWS SDK for Python (Boto3). Here are the step-by-step instructions to remediate this misconfiguration:
  1. Install Boto3: If you haven’t already installed Boto3, you can install it using pip:
  2. Configure AWS Credentials: Make sure you have your AWS credentials configured either through environment variables, shared credentials file, or IAM role.
  3. Use the following Python script to enable log exports for AWS RDS:
  1. Replace 'your_rds_instance_identifier' with the actual identifier of your RDS instance and update the log_types list with the specific log types you want to export (e.g., error, general, slowquery).
  2. Run the Python script to enable log exports for the specified RDS instance.
After running the script, log exports will be enabled for the specified RDS instance with the specified log types. Make sure to review the IAM permissions associated with the AWS credentials used to run the script to ensure they have the necessary permissions to modify RDS instances.
Changing enabled_cloudwatch_logs_exports does not force replacement of the DB instance, but it does overwrite the existing log export set; verify that the listed log types are supported for your engine and that all currently enabled logs are included.To verify, terraform plan should show an in-place update on aws_db_instance.MYSQL_RDS_INSTANCE with enabled_cloudwatch_logs_exports changing from its current value to ["audit", "error", "general", "slowquery", ...] and (optionally) apply_immediately set as configured.