RDS Logging Should Be Enabled

Using Console

Using CLI

To remediate the misconfiguration of RDS logging not being enabled in AWS using AWS CLI, follow these steps:

Enable RDS Enhanced Monitoring: Enhanced Monitoring provides detailed visibility into the performance of your RDS instance. You can enable Enhanced Monitoring for your RDS instance by running the following AWS CLI command:

aws rds modify-db-instance --db-instance-identifier your-db-instance-name --monitoring-interval 60 --monitoring-role-arn arn:aws:iam::123456789012:role/service-role/AmazonRDSEnhancedMonitoringRole

Replace your-db-instance-name with the name of your RDS instance and arn:aws:iam::123456789012:role/service-role/AmazonRDSEnhancedMonitoringRole with the ARN of the IAM role that enables Enhanced Monitoring.

Enable RDS Performance Insights: Performance Insights helps you detect performance problems in your RDS instance. You can enable Performance Insights by running the following AWS CLI command:

aws rds modify-db-instance --db-instance-identifier your-db-instance-name --enable-performance-insights --performance-insights-retention-period 7

Replace your-db-instance-name with the name of your RDS instance and 7 with the desired retention period for Performance Insights data.

Enable RDS Audit Logging: RDS Audit Logging allows you to capture database activities to help meet compliance requirements. You can enable Audit Logging by running the following AWS CLI command:

aws rds modify-db-instance --db-instance-identifier your-db-instance-name --enable-cloudwatch-logs-exports '["audit"]'

Replace your-db-instance-name with the name of your RDS instance.

Verify the Changes: After making these changes, verify that RDS logging is enabled by checking the RDS instance configuration:

aws rds describe-db-instances --db-instance-identifier your-db-instance-name --query "DBInstances[0].[DBInstanceIdentifier,DBInstanceArn,MonitoringInterval,PerformanceInsightsEnabled,EnabledCloudwatchLogsExports]" --output table

Replace your-db-instance-name with the name of your RDS instance.By following these steps and using the AWS CLI commands provided, you can remediate the misconfiguration of RDS logging not being enabled in AWS.

Using Python

To remediate the misconfiguration of RDS logging not being enabled in AWS using Python, you can use the AWS SDK for Python (Boto3) to enable logging for your RDS instance. Follow these steps:

Install Boto3:

pip install boto3

Use the following Python script to enable logging for your RDS instance. Replace <your_rds_instance_identifier> with the actual identifier of your RDS instance.

import boto3

# Specify the region where your RDS instance is located
region = 'us-east-1'

# Specify the identifier of your RDS instance
rds_instance_identifier = '<your_rds_instance_identifier>'

# Create a RDS client
rds_client = boto3.client('rds', region_name=region)

# Enable logging for the RDS instance
response = rds_client.modify_db_instance(
    DBInstanceIdentifier=rds_instance_identifier,
    EnableCloudwatchLogsExports=['error', 'general', 'slowquery']
)

# Print the response
print(response)

Run the Python script. After successful execution, logging should be enabled for your RDS instance.

This script will enable logging for the specified RDS instance and export logs to CloudWatch Logs for the error, general, and slow query logs. You can modify the EnableCloudwatchLogsExports parameter to customize which logs you want to export.Make sure you have the necessary permissions to modify the RDS instance.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

RDS Logging Should Be Enabled

More Info:

Risk Level

Addresses

Compliance Standards

Triage and Remediation

Remediation

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

​More Info:

​Risk Level

​Addresses

​Compliance Standards

​Triage and Remediation