Profile Applicability:
Level 1
Description:
Enable monitoring and logging for your database services (such as RDS, ElastiCache, or QLDB) using Amazon CloudWatch and AWS CloudTrail to gain visibility into performance, health, and security-related activities.
Rationale:
Monitoring and logging help detect unauthorized access, track system performance, and enable timely responses to anomalies or attacks.
Impact:
Without proper logging and monitoring, malicious activity or performance degradation may go unnoticed, leading to data breaches or service disruption.
Default Value:
Monitoring and logging are not enabled by default for many AWS database services.
Pre-requisites:
AWS CloudWatch permissions
CloudTrail enabled (for services supporting API-level audit)
Test Plan:
Using AWS Console:
Sign in to the AWS Management Console.
Navigate to the respective service console (e.g., RDS, ElastiCache, QLDB).
Select the database cluster or instance.
Check the Monitoring/Logging section to verify enhanced monitoring and logging is enabled.
Review CloudWatch metrics, alarms, and logs.
Using AWS CLI:
Describe the database instance:
aws rds describe-db-instances --db-instance-identifier <your-instance-id>
Check for parameters like MonitoringInterval, CloudwatchLogsExportConfiguration, etc.
Implementation Plan:
Using AWS Console:
Go to the respective database service (RDS, ElastiCache, etc.) in the AWS console.
Select the instance/cluster.
Click “Modify”.
Enable Enhanced Monitoring and choose monitoring interval (e.g., 1 min).
Enable log exports (e.g., error logs, audit logs).
Choose or create a CloudWatch log group.
Save and apply changes.
Using AWS CLI:
Modify RDS instance to enable enhanced monitoring:
aws rds modify-db-instance --db-instance-identifier <your-instance-id> --monitoring-interval 60 --apply-immediately
Enable log exports (e.g., audit, error logs):
aws rds modify-db-instance --db-instance-identifier <your-instance-id> --cloudwatch-logs-export-configuration '{"EnableLogTypes":["audit","error"]}' --apply-immediatelyBackout Plan:
Using AWS Console:
Navigate to the service console.
Select the instance and click “Modify”.
Disable Enhanced Monitoring.
Uncheck the enabled log types.
Save and apply changes.
Using AWS CLI:
Disable Enhanced Monitoring:
aws rds modify-db-instance --db-instance-identifier <your-instance-id> --monitoring-interval 0 --apply-immediately Disable log exports:
aws rds modify-db-instance --db-instance-identifier <your-instance-id> --cloudwatch-logs-export-configuration '{"DisableLogTypes":["audit","error"]}' --apply-immediately