​
Event Information

  • The CreateDBSnapshot event in AWS for RDS refers to the action of creating a manual snapshot of a database instance in Amazon RDS (Relational Database Service).
  • This event allows users to capture a point-in-time backup of their database, which can be used for various purposes such as data recovery, database cloning, or creating a new database instance.
  • The CreateDBSnapshot event is typically triggered by users through the AWS Management Console, AWS CLI, or API calls, and it creates a snapshot that is stored in Amazon S3, providing durability and availability for long-term retention.

​
Examples

  • Unauthorized access to the RDS instance: If security is impacted with CreateDBSnapshot in AWS for RDS, it could potentially allow unauthorized users to gain access to the RDS instance. This can lead to unauthorized data access, data modification, or even data loss.

  • Exposure of sensitive data: Creating a DB snapshot involves capturing the entire database, including any sensitive data stored within it. If security is compromised during the CreateDBSnapshot process, it could result in the exposure of sensitive data to unauthorized individuals or entities.

  • Lack of encryption: If encryption is not properly configured during the CreateDBSnapshot process, it can lead to the storage of unencrypted snapshots. This can pose a significant security risk, as the data within the snapshot can be accessed and potentially compromised if it falls into the wrong hands.

​
Remediation

​
Using Console

  1. Enable automated backups:

    • Login to the AWS Management Console and navigate to the Amazon RDS service.
    • Select the RDS instance that needs to be remediated.
    • Click on the “Modify” button.
    • Scroll down to the “Backup” section and enable automated backups by selecting the desired backup retention period.
    • Click on the “Apply Immediately” button to save the changes.

  2. Enable Multi-AZ deployment:

    • Login to the AWS Management Console and navigate to the Amazon RDS service.
    • Select the RDS instance that needs to be remediated.
    • Click on the “Modify” button.
    • Scroll down to the “Deployment” section and enable Multi-AZ deployment by selecting the “Yes” option.
    • Click on the “Apply Immediately” button to save the changes.

  3. Enable encryption at rest:

    • Login to the AWS Management Console and navigate to the Amazon RDS service.
    • Select the RDS instance that needs to be remediated.
    • Click on the “Modify” button.
    • Scroll down to the “Storage” section and enable encryption at rest by selecting the desired encryption option.
    • Click on the “Apply Immediately” button to save the changes.

Note: These steps may vary slightly depending on the AWS Management Console version and layout. Always refer to the official AWS documentation for the most up-to-date instructions.

​
Using CLI

  1. Enable automated backups: To remediate this for AWS RDS using AWS CLI, you can enable automated backups by running the following command:

    aws rds modify-db-instance --db-instance-identifier <db-instance-identifier> --backup-retention-period <backup-retention-period>

    Replace <db-instance-identifier> with the identifier of your RDS instance and <backup-retention-period> with the desired number of days to retain backups.

  2. Enable Multi-AZ deployment: To remediate this for AWS RDS using AWS CLI, you can enable Multi-AZ deployment for high availability by running the following command:

    aws rds modify-db-instance --db-instance-identifier <db-instance-identifier> --multi-az

    Replace <db-instance-identifier> with the identifier of your RDS instance.

  3. Enable encryption at rest: To remediate this for AWS RDS using AWS CLI, you can enable encryption at rest by running the following command:

    aws rds modify-db-instance --db-instance-identifier <db-instance-identifier> --storage-encrypted

    Replace <db-instance-identifier> with the identifier of your RDS instance.

Note: Make sure you have the necessary permissions to modify RDS instances using the AWS CLI.

​
Using Python

To remediate the issues mentioned in the previous response for AWS RDS using Python, you can use the following approaches:

  1. Enable Multi-AZ Deployment:

    • Use the AWS SDK for Python (Boto3) to modify the RDS instance and enable Multi-AZ deployment.
    • Here’s an example Python script to enable Multi-AZ deployment for an RDS instance:
    import boto3

def enable_multi_az(instance_id):
    rds_client = boto3.client('rds')
    response = rds_client.modify_db_instance(
        DBInstanceIdentifier=instance_id,
        MultiAZ=True
    )
    print(response)

# Usage
enable_multi_az('your-db-instance-id')

  2. Enable Automated Backups:

    • Use Boto3 to modify the RDS instance and enable automated backups.
    • Here’s an example Python script to enable automated backups for an RDS instance:
    import boto3

def enable_automated_backups(instance_id):
    rds_client = boto3.client('rds')
    response = rds_client.modify_db_instance(
        DBInstanceIdentifier=instance_id,
        BackupRetentionPeriod=7
    )
    print(response)

# Usage
enable_automated_backups('your-db-instance-id')

  3. Enable Enhanced Monitoring:

    • Use Boto3 to modify the RDS instance and enable enhanced monitoring.
    • Here’s an example Python script to enable enhanced monitoring for an RDS instance:
    import boto3

def enable_enhanced_monitoring(instance_id):
    rds_client = boto3.client('rds')
    response = rds_client.modify_db_instance(
        DBInstanceIdentifier=instance_id,
        MonitoringInterval=60,
        MonitoringRoleArn='arn:aws:iam::123456789012:role/your-monitoring-role'
    )
    print(response)

# Usage
enable_enhanced_monitoring('your-db-instance-id')

Please note that you need to replace 'your-db-instance-id' with the actual identifier of your RDS instance, and provide the appropriate values for other parameters as per your requirements.