docs.aws.amazon.com
Open in
urlscan Pro
13.33.88.70
Public Scan
Submitted URL: https://docs.aws.amazon.com/console/securityhub/RDS.4/remediation
Effective URL: https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html
Submission: On December 28 via api from SG — Scanned from SG
Effective URL: https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html
Submission: On December 28 via api from SG — Scanned from SG
Form analysis 0 forms found in the DOM
Text Content
SELECT YOUR COOKIE PREFERENCES
We use essential cookies and similar tools that are necessary to provide our
site and services. We use performance cookies to collect anonymous statistics so
we can understand how customers use our site and make improvements. Essential
cookies cannot be deactivated, but you can click “Customize cookies” to decline
performance cookies.
If you agree, AWS and approved third parties will also use cookies to provide
useful site features, remember your preferences, and display relevant content,
including relevant advertising. To continue without accepting these cookies,
click “Continue without accepting.” To make more detailed choices or learn more,
click “Customize cookies.”
Accept all cookiesContinue without acceptingCustomize cookies
CUSTOMIZE COOKIE PREFERENCES
We use cookies and similar tools (collectively, "cookies") for the following
purposes.
ESSENTIAL
Essential cookies are necessary to provide our site and services and cannot be
deactivated. They are usually set in response to your actions on the site, such
as setting your privacy preferences, signing in, or filling in forms.
PERFORMANCE
Performance cookies provide anonymous statistics about how customers navigate
our site so we can improve site experience and performance. Approved third
parties may perform analytics on our behalf, but they cannot use the data for
their own purposes.
Allow performance category
Allowed
FUNCTIONAL
Functional cookies help us provide useful site features, remember your
preferences, and display relevant content. Approved third parties may set these
cookies to provide certain site features. If you do not allow these cookies,
then some or all of these services may not function properly.
Allow functional category
Allowed
ADVERTISING
Advertising cookies may be set through our site by us or our advertising
partners and help us deliver relevant marketing content. If you do not allow
these cookies, you will experience less relevant advertising.
Allow advertising category
Allowed
Blocking some types of cookies may impact your experience of our sites. You may
review and change your choices at any time by clicking Cookie preferences in the
footer of this site. We and selected third-parties use cookies or similar
technologies as specified in the AWS Cookie Notice.
CancelSave preferences
UNABLE TO SAVE COOKIE PREFERENCES
We will only store essential cookies at this time, because we were unable to
save your cookie preferences.
If you want to change your cookie preferences, try again later using the link in
the AWS console footer, or contact support if the problem persists.
Dismiss
Contact Us
English
Create an AWS Account
1. AWS
2. ...
3. Documentation
4. AWS Security Hub
5. User Guide
Feedback
Preferences
AWS SECURITY HUB
USER GUIDE
* What is AWS Security Hub?
* Terminology and concepts
* Prerequisites and recommendations
* Enabling Security Hub
* Central configuration
* Start using central configuration
* Choosing management type
* How configuration policies work
* Creating and associating configuration policies
* Viewing configuration policies
* Updating configuration policies
* Deleting and disassociating configuration policies
* In-context configuration
* Stop using central configuration
* Managing administrator and member accounts
* Managing accounts with AWS Organizations
* Integrating Security Hub with AWS Organizations
* Enabling new accounts automatically
* Enabling member accounts
* Disassociating organization member accounts
* Disabling integration with AWS Organizations
* Managing accounts by invitation
* Adding and inviting member accounts
* Responding to an invitation
* Disassociating member accounts
* Deleting member accounts
* Disassociating from your administrator account
* Transitioning to AWS Organizations
* Allowed actions for accounts
* Restrictions and recommendations
* Effect of account actions on Security Hub data
* Cross-Region aggregation
* Central configuration and cross-Region aggregation
* Enabling cross-Region aggregation
* Viewing cross-Region aggregation settings
* Updating the configuration
* Stopping cross-Region aggregation
* Findings
* Creating and updating findings
* Using BatchImportFindings
* Using BatchUpdateFindings
* Viewing a cross-Region finding summary
* Viewing finding lists and details
* Filtering and grouping findings (console)
* Viewing finding details
* Taking action on findings
* Setting the workflow status of findings
* Sending findings to a custom action
* Finding format
* ASFF syntax
* Consolidation and ASFF
* ASFF examples
* Required top-level attributes
* Optional top-level attributes
* Resources
* Resource attributes
* AwsAmazonMQ
* AwsApiGateway
* AwsAppSync
* AwsAthena
* AwsAutoScaling
* AwsBackup
* AwsCertificateManager
* AwsCloudFormation
* AwsCloudFront
* AwsCloudTrail
* AwsCloudWatch
* AwsCodeBuild
* AwsDms
* AwsDynamoDB
* AwsEc2
* AwsEcr
* AwsEcs
* AwsEfs
* AwsEks
* AwsElasticBeanstalk
* AwsElasticSearch
* AwsElb
* AwsEventBridge
* AwsGuardDuty
* AwsIam
* AwsKinesis
* AwsKms
* AwsLambda
* AwsMsk
* AwsNetworkFirewall
* AwsOpenSearchService
* AwsRds
* AwsRedshift
* AwsRoute53
* AwsS3
* AwsSageMaker
* AwsSecretsManager
* AwsSns
* AwsSqs
* AwsSsm
* AwsStepFunctions
* AwsWaf
* AwsXray
* Container
* Other
* Insights
* Viewing and filtering the list of insights
* Viewing insight results and findings
* Managed insights
* Custom insights
* Automations
* Automation rules
* Automated response and remediation
* Types of EventBridge integration
* EventBridge event formats
* Configuring a rule for automatically sent findings
* Configuring and using custom actions
* Product integrations
* Managing product integrations
* AWS service integrations
* Third-party product integrations
* Using custom product integrations
* Standards and controls
* IAM permissions for standards and controls
* Security checks and scores
* AWS Config rules and security checks
* Required AWS Config resources for control findings
* Schedule for running security checks
* Generating and updating control findings
* Determining the control status
* Determining security scores
* Standards reference
* AWS FSBP
* CIS AWS Foundations Benchmark v1.2.0 and v1.4.0
* NIST SP 800-53 Rev. 5
* PCI DSS
* Service-managed standards
* Service-Managed Standard: AWS Control Tower
* Viewing and managing security standards
* Enabling and disabling standards
* Viewing details for a standard
* Enabling and disabling controls in specific standards
* Controls reference
* AWS account controls
* AWS Certificate Manager controls
* API Gateway controls
* AWS AppSync controls
* Athena controls
* AWS Backup controls
* CloudFormation controls
* CloudFront controls
* CloudTrail controls
* CloudWatch controls
* CodeBuild controls
* AWS Config controls
* AWS DMS controls
* Amazon DocumentDB controls
* DynamoDB controls
* Amazon ECR controls
* Amazon ECS controls
* Amazon EC2 controls
* Amazon EC2 Auto Scaling controls
* Amazon EC2 Systems Manager controls
* Amazon EFS controls
* Amazon EKS controls
* ElastiCache controls
* Elastic Beanstalk controls
* Elastic Load Balancing controls
* Amazon EMR controls
* Elasticsearch controls
* EventBridge controls
* Amazon FSx controls
* GuardDuty controls
* IAM controls
* Kinesis controls
* AWS KMS controls
* Lambda controls
* Macie controls
* Amazon MSK controls
* Amazon MQ controls
* Neptune controls
* Network Firewall controls
* OpenSearch Service controls
* AWS Private Certificate Authority controls
* Amazon RDS controls
* Amazon Redshift controls
* Route 53 controls
* Amazon S3 controls
* SageMaker controls
* Secrets Manager controls
* Amazon SNS controls
* Amazon SQS controls
* Step Functions controls
* AWS WAF controls
* Viewing and managing security controls
* Control categories
* Enabling and disabling controls in all standards
* Enabling new controls in enabled standards automatically
* Custom control parameters
* Controls that you might want to disable
* Viewing details for a control
* Filtering and sorting controls
* Viewing and taking action on control findings
* Viewing finding and resource details
* Sample control findings
* Filtering and sorting findings
* Taking action on control findings
* Dashboard
* Creating resources with CloudFormation
* Subscribing to Security Hub announcements
* Security
* Data protection
* AWS Identity and Access Management
* How AWS Security Hub works with IAM
* Using service-linked roles
* AWS managed policies
* Compliance validation
* Infrastructure security
* VPC endpoints (AWS PrivateLink)
* Logging API calls
* Tagging resources
* Quotas
* Security Hub Regional limits
* Regional limits on controls
* Disabling Security Hub
* Controls change log
* Document history
Amazon Relational Database Service controls - AWS Security Hub
AWSDocumentationAWS Security HubUser Guide
[RDS.1] RDS snapshot should be private[RDS.2] RDS DB Instances should prohibit
public access, as determined by the PubliclyAccessible AWS Configuration[RDS.3]
RDS DB instances should have encryption at-rest enabled[RDS.4] RDS cluster
snapshots and database snapshots should be encrypted at rest[RDS.5] RDS DB
instances should be configured with multiple Availability Zones[RDS.6] Enhanced
monitoring should be configured for RDS DB instances[RDS.7] RDS clusters should
have deletion protection enabled[RDS.8] RDS DB instances should have deletion
protection enabled[RDS.9] RDS DB instances should publish logs to CloudWatch
Logs[RDS.10] IAM authentication should be configured for RDS instances[RDS.11]
RDS instances should have automatic backups enabled[RDS.12] IAM authentication
should be configured for RDS clusters[RDS.13] RDS automatic minor version
upgrades should be enabled[RDS.14] Amazon Aurora clusters should have
backtracking enabled[RDS.15] RDS DB clusters should be configured for multiple
Availability Zones[RDS.16] RDS DB clusters should be configured to copy tags to
snapshots[RDS.17] RDS DB instances should be configured to copy tags to
snapshots[RDS.18] RDS instances should be deployed in a VPC[RDS.19] Existing RDS
event notification subscriptions should be configured for critical cluster
events[RDS.20] Existing RDS event notification subscriptions should be
configured for critical database instance events[RDS.21] An RDS event
notifications subscription should be configured for critical database parameter
group events[RDS.22] An RDS event notifications subscription should be
configured for critical database security group events[RDS.23] RDS instances
should not use a database engine default port[RDS.24] RDS Database clusters
should use a custom administrator username[RDS.25] RDS database instances should
use a custom administrator username[RDS.26] RDS DB instances should be protected
by a backup plan[RDS.27] RDS DB clusters should be encrypted at rest[RDS.34]
Aurora MySQL DB clusters should publish audit logs to CloudWatch Logs[RDS.35]
RDS DB clusters should have automatic minor version upgrade enabled
AMAZON RELATIONAL DATABASE SERVICE CONTROLS
PDFRSS
These controls are related to Amazon RDS resources.
These controls may not be available in all AWS Regions. For more information,
see Availability of controls by Region.
[RDS.1] RDS SNAPSHOT SHOULD BE PRIVATE
Related requirements: PCI DSS v3.2.1/1.2.1, PCI DSS v3.2.1/1.3.1, PCI DSS
v3.2.1/1.3.4, PCI DSS v3.2.1/1.3.6, PCI DSS v3.2.1/7.2.1, NIST.800-53.r5 AC-21,
NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-4, NIST.800-53.r5
AC-4(21), NIST.800-53.r5 AC-6, NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11),
NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(20), NIST.800-53.r5 SC-7(21),
NIST.800-53.r5 SC-7(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(9)
Category: Protect > Secure network configuration
Severity: Critical
Resource type: AWS::RDS::DBClusterSnapshot, AWS::RDS::DBSnapshot
AWS Config rule: rds-snapshots-public-prohibited
Schedule type: Change triggered
Parameters: None
This control checks whether Amazon RDS snapshots are public. The control fails
if RDS snapshots are public. This control evaluates RDS instances, Aurora DB
instances, Neptune DB instances, and Amazon DocumentDB clusters.
RDS snapshots are used to back up the data on your RDS instances at a specific
point in time. They can be used to restore previous states of RDS instances.
An RDS snapshot must not be public unless intended. If you share an unencrypted
manual snapshot as public, this makes the snapshot available to all AWS
accounts. This may result in unintended data exposure of your RDS instance.
Note that if the configuration is changed to allow public access, the AWS Config
rule may not be able to detect the change for up to 12 hours. Until the AWS
Config rule detects the change, the check passes even though the configuration
violates the rule.
To learn more about sharing a DB snapshot, see Sharing a DB snapshot in the
Amazon RDS User Guide.
REMEDIATION
To remove public access from RDS snapshots, see Sharing a snapshot in the Amazon
RDS User Guide. For DB snapshot visibility, we choose Private.
[RDS.2] RDS DB INSTANCES SHOULD PROHIBIT PUBLIC ACCESS, AS DETERMINED BY THE
PUBLICLYACCESSIBLE AWS CONFIGURATION
Related requirements: PCI DSS v3.2.1/1.2.1, PCI DSS v3.2.1/1.3.1, PCI DSS
v3.2.1/1.3.2, PCI DSS v3.2.1/1.3.4, PCI DSS v3.2.1/1.3.6, PCI DSS v3.2.1/7.2.1,
NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 SC-7,
NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(21),
NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(5)
Category: Protect > Secure network configuration
Severity: Critical
Resource type: AWS::RDS::DBInstance
AWS Config rule: rds-instance-public-access-check
Schedule type: Change triggered
Parameters: None
This control checks whether Amazon RDS instances are publicly accessible by
evaluating the PubliclyAccessible field in the instance configuration item.
Neptune DB instances and Amazon DocumentDB clusters do not have the
PubliclyAccessible flag and cannot be evaluated. However, this control can still
generate findings for these resources. You can suppress these findings.
The PubliclyAccessible value in the RDS instance configuration indicates whether
the DB instance is publicly accessible. When the DB instance is configured with
PubliclyAccessible, it is an Internet-facing instance with a publicly resolvable
DNS name, which resolves to a public IP address. When the DB instance isn't
publicly accessible, it is an internal instance with a DNS name that resolves to
a private IP address.
Unless you intend for your RDS instance to be publicly accessible, the RDS
instance should not be configured with PubliclyAccessible value. Doing so might
allow unnecessary traffic to your database instance.
REMEDIATION
To remove public access from RDS DB instances, see Modifying an Amazon RDS DB
instance in the Amazon RDS User Guide. For Public access, choose No.
[RDS.3] RDS DB INSTANCES SHOULD HAVE ENCRYPTION AT-REST ENABLED
Related requirements: CIS AWS Foundations Benchmark v1.4.0/2.3.1, NIST.800-53.r5
CA-9(1), NIST.800-53.r5 CM-3(6), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-28,
NIST.800-53.r5 SC-28(1), NIST.800-53.r5 SC-7(10), NIST.800-53.r5 SI-7(6)
Category: Protect > Data protection > Encryption of data at rest
Severity: Medium
Resource type: AWS::RDS::DBInstance
AWS Config rule: rds-storage-encrypted
Schedule type: Change triggered
Parameters: None
This control checks whether storage encryption is enabled for your Amazon RDS DB
instances.
This control is intended for RDS DB instances. However, it can also generate
findings for Aurora DB instances, Neptune DB instances, and Amazon DocumentDB
clusters. If these findings are not useful, then you can suppress them.
For an added layer of security for your sensitive data in RDS DB instances, you
should configure your RDS DB instances to be encrypted at rest. To encrypt your
RDS DB instances and snapshots at rest, enable the encryption option for your
RDS DB instances. Data that is encrypted at rest includes the underlying storage
for DB instances, its automated backups, read replicas, and snapshots.
RDS encrypted DB instances use the open standard AES-256 encryption algorithm to
encrypt your data on the server that hosts your RDS DB instances. After your
data is encrypted, Amazon RDS handles authentication of access and decryption of
your data transparently with a minimal impact on performance. You do not need to
modify your database client applications to use encryption.
Amazon RDS encryption is currently available for all database engines and
storage types. Amazon RDS encryption is available for most DB instance classes.
To learn about DB instance classes that do not support Amazon RDS encryption,
see Encrypting Amazon RDS resources in the Amazon RDS User Guide.
REMEDIATION
For information about encrypting DB instances in Amazon RDS, see Encrypting
Amazon RDS resources in the Amazon RDS User Guide.
[RDS.4] RDS CLUSTER SNAPSHOTS AND DATABASE SNAPSHOTS SHOULD BE ENCRYPTED AT REST
Related requirements: NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-3(6),
NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-28, NIST.800-53.r5 SC-28(1),
NIST.800-53.r5 SC-7(10), NIST.800-53.r5 SI-7(6)
Category: Protect > Data protection > Encryption of data at rest
Severity: Medium
Resource type: AWS::RDS::DBClusterSnapshot, AWS::RDS::DBSnapshot
AWS Config rule: rds-snapshot-encrypted
Schedule type: Change triggered
Parameters: None
This control checks whether an RDS DB snapshot is encrypted. The control fails
if an RDS DB snapshot isn't encrypted.
This control is intended for RDS DB instances. However, it can also generate
findings for snapshots of Aurora DB instances, Neptune DB instances, and Amazon
DocumentDB clusters. If these findings are not useful, then you can suppress
them.
Encrypting data at rest reduces the risk that an unauthenticated user gets
access to data that is stored on disk. Data in RDS snapshots should be encrypted
at rest for an added layer of security.
REMEDIATION
To encrypt an RDS snapshot, see Encrypting Amazon RDS resources in the Amazon
RDS User Guide. When you encrypt an RDS DB instance, the encrypted data includes
the underlying storage for the instance, its automated backups, read replicas,
and snapshots.
You can only encrypt an RDS DB instance when you create it, not after the DB
instance is created. However, because you can encrypt a copy of an unencrypted
snapshot, you can effectively add encryption to an unencrypted DB instance. That
is, you can create a snapshot of your DB instance, and then create an encrypted
copy of that snapshot. You can then restore a DB instance from the encrypted
snapshot, and thus you have an encrypted copy of your original DB instance.
[RDS.5] RDS DB INSTANCES SHOULD BE CONFIGURED WITH MULTIPLE AVAILABILITY ZONES
Related requirements: NIST.800-53.r5 CP-10, NIST.800-53.r5 CP-6(2),
NIST.800-53.r5 SC-36, NIST.800-53.r5 SC-5(2), NIST.800-53.r5 SI-13(5)
Category: Recover > Resilience > High availability
Severity: Medium
Resource type: AWS::RDS::DBInstance
AWS Config rule: rds-multi-az-support
Schedule type: Change triggered
Parameters: None
This control checks whether high availability is enabled for your RDS DB
instances.
RDS DB instances should be configured for multiple Availability Zones (AZs).
This ensures the availability of the data stored. Multi-AZ deployments allow for
automated failover if there is an issue with AZ availability and during regular
RDS maintenance.
REMEDIATION
To deploy your DB instances in multiple AZs, Modifying a DB instance to be a
Multi-AZ DB instance deployment in the Amazon RDS User Guide.
[RDS.6] ENHANCED MONITORING SHOULD BE CONFIGURED FOR RDS DB INSTANCES
Related requirements: NIST.800-53.r5 CA-7, NIST.800-53.r5 SI-2
Category: Detect > Detection services
Severity: Low
Resource type: AWS::RDS::DBInstance
AWS Config rule: rds-enhanced-monitoring-enabled
Schedule type: Change triggered
Parameters:
Parameter Description Type Allowed custom values Security Hub default value
monitoringInterval
Number of seconds between monitoring metric collection intervals
Enum
1, 5, 10, 15, 30, 60
No default value
This control checks whether enhanced monitoring is enabled for an Amazon
Relational Database Service (Amazon RDS) DB instance. The control fails if
enhanced monitoring isn't enabled for the instance. If you provide a custom
value for the monitoringInterval parameter, the control passes only if enhanced
monitoring metrics are collected for the instance at the specified interval.
In Amazon RDS, Enhanced Monitoring enables a more rapid response to performance
changes in underlying infrastructure. These performance changes could result in
a lack of availability of the data. Enhanced Monitoring provides real-time
metrics of the operating system that your RDS DB instance runs on. An agent is
installed on the instance. The agent can obtain metrics more accurately than is
possible from the hypervisor layer.
Enhanced Monitoring metrics are useful when you want to see how different
processes or threads on a DB instance use the CPU. For more information, see
Enhanced Monitoring in the Amazon RDS User Guide.
REMEDIATION
For detailed instructions on enabling Enhanced Monitoring for your DB instance,
see Setting up for and enabling Enhanced Monitoring in the Amazon RDS User
Guide.
[RDS.7] RDS CLUSTERS SHOULD HAVE DELETION PROTECTION ENABLED
Related requirements: NIST.800-53.r5 CM-3, NIST.800-53.r5 SC-5(2)
Category: Protect > Data protection > Data deletion protection
Severity: Low
Resource type: AWS::RDS::DBCluster
AWS Config rule: rds-cluster-deletion-protection-enabled
Schedule type: Change triggered
Parameters: None
This control checks whether an RDS DB cluster has deletion protection enabled.
The control fails if an RDS DB cluster doesn't have deletion protection enabled.
This control is intended for RDS DB instances. However, it can also generate
findings for Aurora DB instances, Neptune DB instances, and Amazon DocumentDB
clusters. If these findings are not useful, then you can suppress them.
Enabling cluster deletion protection is an additional layer of protection
against accidental database deletion or deletion by an unauthorized entity.
When deletion protection is enabled, an RDS cluster cannot be deleted. Before a
deletion request can succeed, deletion protection must be disabled.
REMEDIATION
To enable deletion protection for an RDS DB cluster, see Modifying the DB
cluster by using the console, CLI, and API in the Amazon RDS User Guide. For
Deletion protection, choose Enable deletion protection.
[RDS.8] RDS DB INSTANCES SHOULD HAVE DELETION PROTECTION ENABLED
Related requirements: NIST.800-53.r5 CM-3, NIST.800-53.r5 SC-5(2),
NIST.800-53.r5 SI-13(5)
Category: Protect > Data protection > Data deletion protection
Severity: Low
Resource type: AWS::RDS::DBInstance
AWS Config rule: rds-instance-deletion-protection-enabled
Schedule type: Change triggered
Parameters:
* databaseEngines:
mariadb,mysql,oracle-ee,oracle-se2,oracle-se1,oracle-se,postgres,sqlserver-ee,sqlserver-se,sqlserver-ex,sqlserver-web
(not customizable)
This control checks whether your RDS DB instances that use one of the listed
database engines have deletion protection enabled. The control fails if an RDS
DB instance doesn't have deletion protection enabled.
Enabling instance deletion protection is an additional layer of protection
against accidental database deletion or deletion by an unauthorized entity.
While deletion protection is enabled, an RDS DB instance cannot be deleted.
Before a deletion request can succeed, deletion protection must be disabled.
REMEDIATION
To enable deletion protection for an RDS DB instance, see Modifying an Amazon
RDS DB instance in the Amazon RDS User Guide. For Deletion protection, choose
Enable deletion protection.
[RDS.9] RDS DB INSTANCES SHOULD PUBLISH LOGS TO CLOUDWATCH LOGS
IMPORTANT
In December 2023, the title of this control changed to the title shown here. For
more information, see Change log for Security Hub controls.
Related requirements: NIST.800-53.r5 AC-2(4), NIST.800-53.r5 AC-4(26),
NIST.800-53.r5 AC-6(9), NIST.800-53.r5 AU-10, NIST.800-53.r5 AU-12,
NIST.800-53.r5 AU-2, NIST.800-53.r5 AU-3, NIST.800-53.r5 AU-6(3), NIST.800-53.r5
AU-6(4), NIST.800-53.r5 CA-7, NIST.800-53.r5 SC-7(10), NIST.800-53.r5 SC-7(9),
NIST.800-53.r5 SI-3(8), NIST.800-53.r5 SI-4(20), NIST.800-53.r5 SI-7(8)
Category: Identify > Logging
Severity: Medium
Resource type: AWS::RDS::DBInstance
AWS Config rule: rds-logging-enabled
Schedule type: Change triggered
Parameters: None
This control checks whether an Amazon RDS DB instance is configured to publish
the following logs to Amazon CloudWatch Logs. The control fails if the instance
isn’t configured to publish the following logs to CloudWatch Logs:
* Oracle: (Alert, Audit, Trace, Listener)
* PostgreSQL: (Postgresql, Upgrade)
* MySQL: (Audit, Error, General, SlowQuery)
* MariaDB: (Audit, Error, General, SlowQuery)
* SQL Server: (Error, Agent)
* Aurora: (Audit, Error, General, SlowQuery)
* Aurora-MySQL: (Audit, Error, General, SlowQuery)
* Aurora-PostgreSQL: (Postgresql, Upgrade).
RDS databases should have relevant logs enabled. Database logging provides
detailed records of requests made to RDS. Database logs can assist with security
and access audits and can help to diagnose availability issues.
REMEDIATION
To publish RDS database logs to CloudWatch Logs, see Specifying the logs to
publish to CloudWatch Logs in the Amazon RDS User Guide.
[RDS.10] IAM AUTHENTICATION SHOULD BE CONFIGURED FOR RDS INSTANCES
Related requirements: NIST.800-53.r5 AC-2(1), NIST.800-53.r5 AC-3,
NIST.800-53.r5 AC-3(15), NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-6
Category: Protect > Secure access management > Passwordless authentication
Severity: Medium
Resource type: AWS::RDS::DBInstance
AWS Config rule: rds-instance-iam-authentication-enabled
Schedule type: Change triggered
Parameters: None
This control checks whether an RDS DB instance has IAM database authentication
enabled. The control fails if IAM authentication is not configured for RDS DB
instances. This control only evaluates RDS instances with the following engine
types: mysql, postgres, aurora, aurora-mysql, aurora-postgresql, and mariadb. An
RDS instance must also be in one of the following states for a finding to be
generated: available, backing-up, storage-optimization, or storage-full.
IAM database authentication allows authentication to database instances with an
authentication token instead of a password. Network traffic to and from the
database is encrypted using SSL. For more information, see IAM database
authentication in the Amazon Aurora User Guide.
REMEDIATION
To activate IAM database authentication on an RDS DB instance, see Enabling and
disabling IAM database authentication in the Amazon RDS User Guide.
[RDS.11] RDS INSTANCES SHOULD HAVE AUTOMATIC BACKUPS ENABLED
Related requirements: NIST.800-53.r5 CP-10, NIST.800-53.r5 CP-6, NIST.800-53.r5
CP-6(1), NIST.800-53.r5 CP-6(2), NIST.800-53.r5 CP-9, NIST.800-53.r5 SC-5(2),
NIST.800-53.r5 SI-12, NIST.800-53.r5 SI-13(5)
Category: Recover > Resilience > Backups enabled
Severity: Medium
Resource type: AWS::RDS::DBInstance
AWS Config rule: db-instance-backup-enabled
Schedule type: Change triggered
Parameters:
Parameter Description Type Allowed custom values Security Hub default value
backupRetentionMinimum
Minimum backup retention period in days
Integer
7 to 35
7
checkReadReplicas
Checks whether RDS DB instances have backups enabled for read replicas
Boolean
Not customizable
false
This control checks whether an Amazon Relational Database Service instance has
automated backups enabled, and a backup retention period greater than or equal
to the specified time frame. Read replicas are excluded from evaluation. The
control fails if backups aren't enabled for the instance, or if the retention
period is less than the specified time frame. Unless you provide a custom
parameter value for the backup retention period, Security Hub uses a default
value of 7 days.
Backups help you more quickly recover from a security incident and strengthens
the resilience of your systems. Amazon RDS lets you configure daily full
instance volume snapshots. For more information about Amazon RDS automated
backups, see Working with Backups in the Amazon RDS User Guide.
REMEDIATION
To enable automated backups on an RDS DB instance, see Enabling automated
backups in the Amazon RDS User Guide.
[RDS.12] IAM AUTHENTICATION SHOULD BE CONFIGURED FOR RDS CLUSTERS
Related requirements: NIST.800-53.r5 AC-2(1), NIST.800-53.r5 AC-3,
NIST.800-53.r5 AC-3(15), NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-6
Category: Protect > Secure access management > Passwordless authentication
Severity: Medium
Resource type: AWS::RDS::DBCluster
AWS Config rule: rds-cluster-iam-authentication-enabled
Schedule type: Change triggered
Parameters: None
This control checks whether an Amazon RDS DB cluster has IAM database
authentication enabled.
IAM database authentication allows for password-free authentication to database
instances. The authentication uses an authentication token. Network traffic to
and from the database is encrypted using SSL. For more information, see IAM
database authentication in the Amazon Aurora User Guide.
REMEDIATION
To enable IAM authentication for a DB cluster, see Enabling and disabling IAM
database authentication in the Amazon Aurora User Guide.
[RDS.13] RDS AUTOMATIC MINOR VERSION UPGRADES SHOULD BE ENABLED
Related requirements: NIST.800-53.r5 SI-2, NIST.800-53.r5 SI-2(2),
NIST.800-53.r5 SI-2(4), NIST.800-53.r5 SI-2(5)
Category: Detect > Vulnerability and patch management
Severity: High
Resource type: AWS::RDS::DBInstance
AWS Config rule: rds-automatic-minor-version-upgrade-enabled
Schedule type: Change triggered
Parameters: None
This control checks whether automatic minor version upgrades are enabled for the
RDS database instance.
Enabling automatic minor version upgrades ensures that the latest minor version
updates to the relational database management system (RDBMS) are installed.
These upgrades might include security patches and bug fixes. Keeping up to date
with patch installation is an important step in securing systems.
REMEDIATION
To enable automatic minor version upgrades for an existing DB instance, see
Modifying an Amazon RDS DB instance in the Amazon RDS User Guide. For Auto minor
version upgrade, select Yes.
[RDS.14] AMAZON AURORA CLUSTERS SHOULD HAVE BACKTRACKING ENABLED
Related requirements: NIST.800-53.r5 CP-10, NIST.800-53.r5 CP-6, NIST.800-53.r5
CP-6(1), NIST.800-53.r5 CP-6(2), NIST.800-53.r5 CP-9, NIST.800-53.r5 SI-13(5)
Category: Recover > Resilience > Backups enabled
Severity: Medium
Resource type: AWS::RDS::DBCluster
AWS Config rule: aurora-mysql-backtracking-enabled
Schedule type: Change triggered
Parameters:
Parameter Description Type Allowed custom values Security Hub default value
BacktrackWindowInHours
Number of hours to backtrack an Aurora MySQL cluster
Double
0.1 to 72
No default value
This control checks whether an Amazon Aurora cluster has backtracking enabled.
The control fails if the cluster doesn't have backtracking enabled. If you
provide a custom value for the BacktrackWindowInHours parameter, the control
passes only if the cluster is backtracked for the specified length of time.
Backups help you to recover more quickly from a security incident. They also
strengthens the resilience of your systems. Aurora backtracking reduces the time
to recover a database to a point in time. It does not require a database restore
to do so.
REMEDIATION
To enable Aurora backtracking, see Configuring backtracking in the Amazon Aurora
User Guide.
Note that you cannot enable backtracking on an existing cluster. Instead, you
can create a clone that has backtracking enabled. For more information about the
limitations of Aurora backtracking, see the list of limitations in Overview of
backtracking.
[RDS.15] RDS DB CLUSTERS SHOULD BE CONFIGURED FOR MULTIPLE AVAILABILITY ZONES
Related requirements: NIST.800-53.r5 CP-10, NIST.800-53.r5 CP-6(2),
NIST.800-53.r5 SC-36, NIST.800-53.r5 SC-5(2), NIST.800-53.r5 SI-13(5)
Category: Recover > Resilience > High availability
Severity: Medium
Resource type: AWS::RDS::DBCluster
AWS Config rule: rds-cluster-multi-az-enabled
Schedule type: Change triggered
Parameters: None
This control checks whether high availability is enabled for your RDS DB
clusters. The control fails if an RDS DB cluster isn't deployed in multiple
Availability Zones (AZs).
RDS DB clusters should be configured for multiple AZs to ensure availability of
stored data. Deployment to multiple AZs allows for automated failover in the
event of an AZ availability issue and during regular RDS maintenance events.
REMEDIATION
To deploy your DB clusters in multiple AZs, Modifying a DB instance to be a
Multi-AZ DB instance deployment in the Amazon RDS User Guide.
Remediation steps differ for Aurora global databases. To configure multiple
Availability Zones for an Aurora global database, select your DB cluster. Then,
choose Actions and Add reader, and specify multiple AZs. For more information,
see Adding Aurora Replicas to a DB cluster in the Amazon Aurora User Guide.
[RDS.16] RDS DB CLUSTERS SHOULD BE CONFIGURED TO COPY TAGS TO SNAPSHOTS
Related requirements: NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2,
NIST.800-53.r5 CM-2(2)
Category: Identify > Inventory
Severity: Low
Resource type: AWS::RDS::DBCluster
AWS Config rule: rds-cluster-copy-tags-to-snapshots-enabled (custom Security Hub
rule)
Schedule type: Change triggered
Parameters: None
This control checks whether RDS DB clusters are configured to copy all tags to
snapshots when the snapshots are created.
Identification and inventory of your IT assets is a crucial aspect of governance
and security. You need to have visibility of all your RDS DB clusters so that
you can assess their security posture and take action on potential areas of
weakness. Snapshots should be tagged in the same way as their parent RDS
database clusters. Enabling this setting ensures that snapshots inherit the tags
of their parent database clusters.
REMEDIATION
To automatically copy tags to snapshots for an RDS DB cluster, see Modifying the
DB cluster by using the console, CLI, and API in the Amazon Aurora User Guide.
Select Copy tags to snapshots.
[RDS.17] RDS DB INSTANCES SHOULD BE CONFIGURED TO COPY TAGS TO SNAPSHOTS
Related requirements: NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2,
NIST.800-53.r5 CM-2(2)
Category: Identify > Inventory
Severity: Low
Resource type: AWS::RDS::DBInstance
AWS Config rule: rds-instance-copy-tags-to-snapshots-enabled (custom Security
Hub rule)
Schedule type: Change triggered
Parameters: None
This control checks whether RDS DB instances are configured to copy all tags to
snapshots when the snapshots are created.
Identification and inventory of your IT assets is a crucial aspect of governance
and security. You need to have visibility of all your RDS DB instances so that
you can assess their security posture and take action on potential areas of
weakness. Snapshots should be tagged in the same way as their parent RDS
database instances. Enabling this setting ensures that snapshots inherit the
tags of their parent database instances.
REMEDIATION
To automatically copy tags to snapshots for an RDS DB instance, see Modifying an
Amazon RDS DB instance in the Amazon RDS User Guide. Select Copy tags to
snapshots.
[RDS.18] RDS INSTANCES SHOULD BE DEPLOYED IN A VPC
Related requirements: NIST.800-53.r5 AC-21, NIST.800-53.r5 AC-3, NIST.800-53.r5
AC-3(7), NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 AC-6,
NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16),
NIST.800-53.r5 SC-7(20), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(3),
NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(9)
Category: Protect > Secure network configuration > Resources within VPC
Severity: High
Resource type: AWS::RDS::DBInstance
AWS Config rule: rds-deployed-in-vpc (custom Security Hub rule)
Schedule type: Change triggered
Parameters: None
This control checks whether an Amazon RDS instance is deployed on an EC2-VPC.
VPCs provide a number of network controls to secure access to RDS resources.
These controls include VPC Endpoints, network ACLs, and security groups. To take
advantage of these controls, we recommend that you create your RDS instances on
an EC2-VPC.
REMEDIATION
For instructions on moving RDS instances to a VPC, see Updating the VPC for a DB
instance in the Amazon RDS User Guide.
[RDS.19] EXISTING RDS EVENT NOTIFICATION SUBSCRIPTIONS SHOULD BE CONFIGURED FOR
CRITICAL CLUSTER EVENTS
Related requirements: NIST.800-53.r5 CA-7, NIST.800-53.r5 SI-2
Category: Detect > Detection services > Application monitoring
Severity: Low
Resource type: AWS::RDS::EventSubscription
AWS Config rule: rds-cluster-event-notifications-configured (custom Security Hub
rule)
Schedule type: Change triggered
Parameters: None
This control checks whether an existing Amazon RDS event subscription for
database clusters has notifications enabled for the following source type and
event category key-value pairs:
DBCluster: ["maintenance","failure"]
The control passes if there are no existing event subscriptions in your account.
RDS event notifications uses Amazon SNS to make you aware of changes in the
availability or configuration of your RDS resources. These notifications allow
for rapid response. For additional information about RDS event notifications,
see Using Amazon RDS event notification in the Amazon RDS User Guide.
REMEDIATION
To subscribe to RDS cluster event notifications, see Subscribing to Amazon RDS
event notification in the Amazon RDS User Guide. Use the following values:
Field Value
Source type
Clusters
Clusters to include
All clusters
Event categories to include
Select specific event categories or All event categories
[RDS.20] EXISTING RDS EVENT NOTIFICATION SUBSCRIPTIONS SHOULD BE CONFIGURED FOR
CRITICAL DATABASE INSTANCE EVENTS
Related requirements: NIST.800-53.r5 CA-7, NIST.800-53.r5 SI-2
Category: Detect > Detection services > Application monitoring
Severity: Low
Resource type: AWS::RDS::EventSubscription
AWS Config rule: rds-instance-event-notifications-configured (custom Security
Hub rule)
Schedule type: Change triggered
Parameters: None
This control checks whether an existing Amazon RDS event subscription for
database instances has notifications enabled for the following source type and
event category key-value pairs:
DBInstance: ["maintenance","configuration change","failure"]
The control passes if there are no existing event subscriptions in your account.
RDS event notifications use Amazon SNS to make you aware of changes in the
availability or configuration of your RDS resources. These notifications allow
for rapid response. For additional information about RDS event notifications,
see Using Amazon RDS event notification in the Amazon RDS User Guide.
REMEDIATION
To subscribe to RDS instance event notifications, see Subscribing to Amazon RDS
event notification in the Amazon RDS User Guide. Use the following values:
Field Value
Source type
Instances
Instances to include
All instances
Event categories to include
Select specific event categories or All event categories
[RDS.21] AN RDS EVENT NOTIFICATIONS SUBSCRIPTION SHOULD BE CONFIGURED FOR
CRITICAL DATABASE PARAMETER GROUP EVENTS
Related requirements: NIST.800-53.r5 CA-7, NIST.800-53.r5 SI-2
Category: Detect > Detection services > Application monitoring
Severity: Low
Resource type: AWS::RDS::EventSubscription
AWS Config rule: rds-pg-event-notifications-configured (custom Security Hub
rule)
Schedule type: Change triggered
Parameters: None
This control checks whether an Amazon RDS event subscription exists with
notifications enabled for the following source type, event category key-value
pairs.
DBParameterGroup: ["configuration change"]
RDS event notifications use Amazon SNS to make you aware of changes in the
availability or configuration of your RDS resources. These notifications allow
for rapid response. For additional information about RDS event notifications,
see Using Amazon RDS event notification in the Amazon RDS User Guide.
REMEDIATION
To subscribe to RDS database parameter group event notifications, see
Subscribing to Amazon RDS event notification in the Amazon RDS User Guide. Use
the following values:
Field Value
Source type
Parameter groups
Parameter groups to include
All parameter groups
Event categories to include
Select specific event categories or All event categories
[RDS.22] AN RDS EVENT NOTIFICATIONS SUBSCRIPTION SHOULD BE CONFIGURED FOR
CRITICAL DATABASE SECURITY GROUP EVENTS
Related requirements: NIST.800-53.r5 CA-7, NIST.800-53.r5 SI-2
Category: Detect > Detection Services > Application monitoring
Severity: Low
Resource type: AWS::RDS::EventSubscription
AWS Config rule: rds-sg-event-notifications-configured (custom Security Hub
rule)
Schedule type: Change triggered
Parameters: None
This control checks whether an Amazon RDS event subscription exists with
notifications enabled for the following source type, event category key-value
pairs.
DBSecurityGroup: ["configuration change","failure"]
RDS event notifications use Amazon SNS to make you aware of changes in the
availability or configuration of your RDS resources. These notifications allow
for a rapid response. For additional information about RDS event notifications,
see Using Amazon RDS event notification in the Amazon RDS User Guide.
REMEDIATION
To subscribe to RDS instance event notifications, see Subscribing to Amazon RDS
event notification in the Amazon RDS User Guide. Use the following values:
Field Value
Source type
Security groups
Security groups to include
All security groups
Event categories to include
Select specific event categories or All event categories
[RDS.23] RDS INSTANCES SHOULD NOT USE A DATABASE ENGINE DEFAULT PORT
Related requirements: NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21),
NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16),
NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(5)
Category: Protect > Secure network configuration
Severity: Low
Resource type: AWS::RDS::DBInstance
AWS Config rule: rds-no-default-ports (custom Security Hub rule)
Schedule type: Change triggered
Parameters: None
This control checks whether an RDS cluster or instance uses a port other than
the default port of the database engine. The control fails if the RDS cluster or
instance uses the default port.
If you use a known port to deploy an RDS cluster or instance, an attacker can
guess information about the cluster or instance. The attacker can use this
information in conjunction with other information to connect to an RDS cluster
or instance or gain additional information about your application.
When you change the port, you must also update the existing connection strings
that were used to connect to the old port. You should also check the security
group of the DB instance to ensure that it includes an ingress rule that allows
connectivity on the new port.
REMEDIATION
To modify the default port of an existing RDS DB instance, see Modifying an
Amazon RDS DB instance in the Amazon RDS User Guide. To modify the default port
of an existing RDS DB cluster, see Modifying the DB cluster by using the
console, CLI, and API in the Amazon Aurora User Guide. For Database port, change
the port value to a non-default value.
[RDS.24] RDS DATABASE CLUSTERS SHOULD USE A CUSTOM ADMINISTRATOR USERNAME
Related requirements: NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2
Category: Identify > Resource Configuration
Severity: Medium
Resource type: AWS::RDS::DBCluster
AWS Config rule: rds-cluster-default-admin-check
Schedule type: Change triggered
Parameters: None
This control checks whether an Amazon RDS database cluster has changed the admin
username from its default value. The control does not apply to engines of the
type neptune (Neptune DB) or docdb (DocumentDB). This rule will fail if the
admin username is set to the default value.
When creating an Amazon RDS database, you should change the default admin
username to a unique value. Default usernames are public knowledge and should be
changed during RDS database creation. Changing the default usernames reduces the
risk of unintended access.
REMEDIATION
For changing the admin username associated with the Amazon RDS database cluster,
create a new RDS database cluster and change the default admin username while
creating the database.
[RDS.25] RDS DATABASE INSTANCES SHOULD USE A CUSTOM ADMINISTRATOR USERNAME
Related requirements: NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2
Category: Identify > Resource Configuration
Severity: Medium
Resource type: AWS::RDS::DBInstance
AWS Config rule: rds-instance-default-admin-check
Schedule type: Change triggered
Parameters: None
This control checks whether you've changed the administrative username for
Amazon Relational Database Service (Amazon RDS) database instances from the
default value. The control does not apply to engines of the type neptune
(Neptune DB) or docdb (DocumentDB). The control fails if the administrative
username is set to the default value.
Default administrative usernames on Amazon RDS databases are public knowledge.
When creating an Amazon RDS database, you should change the default
administrative username to a unique value to reduce the risk of unintended
access.
REMEDIATION
To change the administrative username associated with an RDS database instance,
first create a new RDS database instance. Change the default administrative
username while creating the database.
[RDS.26] RDS DB INSTANCES SHOULD BE PROTECTED BY A BACKUP PLAN
Category: Recover > Resilience > Backups enabled
Related requirements: NIST.800-53.r5 CP-10, NIST.800-53.r5 CP-6, NIST.800-53.r5
CP-6(1), NIST.800-53.r5 CP-6(2), NIST.800-53.r5 CP-9, NIST.800-53.r5 SC-5(2),
NIST.800-53.r5 SI-12, NIST.800-53.r5 SI-13(5)
Severity: Medium
Resource type: AWS::RDS::DBInstance
AWS Config rule: rds-resources-protected-by-backup-plan
Schedule type: Periodic
Parameters:
Parameter Description Type Allowed custom values Security Hub default value
backupVaultLockCheck
The control produces a PASSED finding if the parameter is set to true and the
resource uses AWS Backup Vault Lock.
Boolean
true or false
No default value
This control evaluates if Amazon RDS DB instances are covered by a backup plan.
This control fails if the RDS DB instance isn't covered by a backup plan. If you
set the backupVaultLockCheck parameter equal to true, the control passes only if
the instance is backed up in an AWS Backup locked vault.
AWS Backup is a fully managed backup service that centralizes and automates the
backing up of data across AWS services. With AWS Backup, you can create backup
policies called backup plans. You can use these plans to define your backup
requirements, such as how frequently to back up your data and how long to retain
those backups. Including RDS DB instances in a backup plan helps you protect
your data from unintended loss or deletion.
REMEDIATION
To add an RDS DB instance to an AWS Backup backup plan, see Assigning resources
to a backup plan in the AWS Backup Developer Guide.
[RDS.27] RDS DB CLUSTERS SHOULD BE ENCRYPTED AT REST
Related requirements: NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-3(6),
NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-28, NIST.800-53.r5 SC-28(1),
NIST.800-53.r5 SC-7(10), NIST.800-53.r5 SI-7(6)
Category: Protect > Data protection > Encryption of data at rest
Severity: Medium
Resource type: AWS::RDS::DBCluster
AWS Config rule: rds-cluster-encrypted-at-rest
Schedule type: Change triggered
Parameters: None
This control checks if an RDS DB cluster is encrypted at rest. The control fails
if an RDS DB cluster isn't encrypted at rest.
Data at rest refers to any data that's stored in persistent, non-volatile
storage for any duration. Encryption helps you protect the confidentiality of
such data, reducing the risk that an unauthorized user can access it. Encrypting
your RDS DB clusters protects your data and metadata against unauthorized
access. It also fulfills compliance requirements for data-at-rest encryption of
production file systems.
REMEDIATION
You can enable encryption at rest when you create an RDS DB cluster. You can't
change encryption settings after creating a cluster. For more information, see
Encrypting an Amazon Aurora DB cluster in the Amazon Aurora User Guide.
[RDS.34] AURORA MYSQL DB CLUSTERS SHOULD PUBLISH AUDIT LOGS TO CLOUDWATCH LOGS
Related requirements: NIST.800-53.r5 AC-2(4), NIST.800-53.r5 AC-4(26),
NIST.800-53.r5 AC-6(9), NIST.800-53.r5 AU-10, NIST.800-53.r5 AU-12,
NIST.800-53.r5 AU-2, NIST.800-53.r5 AU-3, NIST.800-53.r5 AU-6(3), NIST.800-53.r5
AU-6(4), NIST.800-53.r5 CA-7, NIST.800-53.r5 SC-7(9), NIST.800-53.r5 SI-3(8),
NIST.800-53.r5 SI-4(20), NIST.800-53.r5 SI-7(8)
Category: Identify > Logging
Severity: Medium
Resource type: AWS::RDS::DBCluster
AWS Config rule: rds-aurora-mysql-audit-logging-enabled
Schedule type: Change triggered
Parameters: None
This control checks whether an Amazon Aurora MySQL DB cluster is configured to
publish audit logs to Amazon CloudWatch Logs. The control fails if the cluster
isn't configured to publish audit logs to CloudWatch Logs.
Audit logs capture a record of database activity, including login attempts, data
modifications, schema changes, and other events that can be audited for security
and compliance purposes. When you configure an Aurora MySQL DB cluster to
publish audit logs to a log group in Amazon CloudWatch Logs, you can perform
real-time analysis of the log data. CloudWatch Logs retains logs in highly
durable storage. You can also create alarms and view metrics in CloudWatch.
NOTE
An alternative way to publish audit logs to CloudWatch Logs is by enabling
advanced auditing and setting the cluster-level DB parameter
server_audit_logs_upload to 1. The default for the server_audit_logs_upload
parameter is 0. However, we recommend you use the following remediation
instructions instead to pass this control.
REMEDIATION
To publish Aurora MySQL DB cluster audit logs to CloudWatch Logs, see Publishing
Amazon Aurora MySQL logs to Amazon CloudWatch Logs in the Amazon Aurora User
Guide.
[RDS.35] RDS DB CLUSTERS SHOULD HAVE AUTOMATIC MINOR VERSION UPGRADE ENABLED
Related requirements: NIST.800-53.r5 SI-2, NIST.800-53.r5 SI-2(2),
NIST.800-53.r5 SI-2(4), NIST.800-53.r5 SI-2(5)
Category: Detect > Vulnerability, patch, and version management
Severity: Medium
Resource type: AWS::RDS::DBCluster
AWS Config rule: rds-cluster-auto-minor-version-upgrade-enable
Schedule type: Change triggered
Parameters: None
This control checks if automatic minor version upgrade is enabled for an Amazon
RDS database cluster. The control fails if automatic minor version upgrade isn't
enabled for an RDS cluster.
RDS provides automatic minor version upgrade so that you can keep your RDS
database cluster up to date. Minor versions can introduce new software features,
bug fixes, security patches, and performance improvements. By enabling automatic
minor version upgrade on RDS database clusters, the cluster, along with the
instances in the cluster, will receive automatic updates to the minor version
when new versions are available. The updates are applied automatically during
the maintenance window.
REMEDIATION
To enable automatic minor version upgrade on RDS database clusters, see
Modifying the DB cluster by using the console, CLI, and API in the Amazon Aurora
User Guide.
Javascript is disabled or is unavailable in your browser.
To use the Amazon Web Services Documentation, Javascript must be enabled. Please
refer to your browser's Help pages for instructions.
Document Conventions
AWS Private Certificate Authority controls
Amazon Redshift controls
Did this page help you? - Yes
Thanks for letting us know we're doing a good job!
If you've got a moment, please tell us what we did right so we can do more of
it.
Did this page help you? - No
Thanks for letting us know this page needs work. We're sorry we let you down.
If you've got a moment, please tell us how we can make the documentation better.
DID THIS PAGE HELP YOU?
Yes
No
Provide feedback
NEXT TOPIC:
Amazon Redshift controls
PREVIOUS TOPIC:
AWS Private Certificate Authority controls
NEED HELP?
* Connect with an AWS IQ expert
PrivacySite termsCookie preferences
© 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved.
ON THIS PAGE
* [RDS.1] RDS snapshot should be private
* [RDS.2] RDS DB Instances should prohibit public access, as determined by the
PubliclyAccessible AWS Configuration
* [RDS.3] RDS DB instances should have encryption at-rest enabled
* [RDS.4] RDS cluster snapshots and database snapshots should be encrypted at
rest
* [RDS.5] RDS DB instances should be configured with multiple Availability
Zones
* [RDS.6] Enhanced monitoring should be configured for RDS DB instances
* [RDS.7] RDS clusters should have deletion protection enabled
* [RDS.8] RDS DB instances should have deletion protection enabled
* [RDS.9] RDS DB instances should publish logs to CloudWatch Logs
* [RDS.10] IAM authentication should be configured for RDS instances
* [RDS.11] RDS instances should have automatic backups enabled
* [RDS.12] IAM authentication should be configured for RDS clusters
* [RDS.13] RDS automatic minor version upgrades should be enabled
* [RDS.14] Amazon Aurora clusters should have backtracking enabled
* [RDS.15] RDS DB clusters should be configured for multiple Availability Zones
* [RDS.16] RDS DB clusters should be configured to copy tags to snapshots
* [RDS.17] RDS DB instances should be configured to copy tags to snapshots
* [RDS.18] RDS instances should be deployed in a VPC
* [RDS.19] Existing RDS event notification subscriptions should be configured
for critical cluster events
* [RDS.20] Existing RDS event notification subscriptions should be configured
for critical database instance events
* [RDS.21] An RDS event notifications subscription should be configured for
critical database parameter group events
* [RDS.22] An RDS event notifications subscription should be configured for
critical database security group events
* [RDS.23] RDS instances should not use a database engine default port
* [RDS.24] RDS Database clusters should use a custom administrator username
* [RDS.25] RDS database instances should use a custom administrator username
* [RDS.26] RDS DB instances should be protected by a backup plan
* [RDS.27] RDS DB clusters should be encrypted at rest
* [RDS.34] Aurora MySQL DB clusters should publish audit logs to CloudWatch
Logs
* [RDS.35] RDS DB clusters should have automatic minor version upgrade enabled
DID THIS PAGE HELP YOU? - NO
Thanks for letting us know this page needs work. We're sorry we let you down.
If you've got a moment, please tell us how we can make the documentation better.
Feedback
INTRODUCING AMAZON Q
Receive guidance, get troubleshooting tips, and learn about AWS services and
capabilities.