Description

Ensure that every Amazon RDS DB instance publishes at least one of its database logs to Amazon CloudWatch Logs. Depending on the engine, the available log types include the error, general, slow query and audit logs (MySQL and MariaDB), the PostgreSQL log, the alert, audit, listener and trace logs (Oracle) and the agent and error logs (SQL Server).

Rationale

When database logs stay only on the DB instance, they are hard to search, are kept for a limited time and cannot be used for alerts. This hides failed logins, credential misuse, SQL injection attempts, data exfiltration and privilege abuse, and slows down troubleshooting of errors and slow queries. Exporting the logs to CloudWatch Logs centralizes them, allows retention to be set, and makes it possible to create metric filters and alarms or to forward the logs to a SIEM.

Impact

  • Centralizes database logs for monitoring, alerting and investigations

  • Allows log retention to be controlled independently of the DB instance

  • CloudWatch Logs ingestion and storage are charged, which can be significant for verbose logs such as the general log

  • Some log types, such as the MySQL general and slow query logs, also need to be turned on in the DB parameter group before they produce data

Default Value

Log export to CloudWatch Logs is disabled by default. No log types are published until they are selected.

Pre-Requisites

  • IAM permissions: rds:DescribeDBInstances and rds:ModifyDBInstance

  • A decision on which log types to export for each engine

  • For MySQL and MariaDB general and slow query logs, a custom DB parameter group with general_log or slow_query_log set to 1 and log_output set to FILE

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon RDS console and select Databases.

  3. Select a DB instance and open the Configuration tab.

  4. Check which log types are published to CloudWatch Logs.

  5. Repeat for each DB instance in each region in use.

  6. If no log type is published, follow the implementation steps.

CLI:

Show the log types exported to CloudWatch Logs for all DB instances:

aws rds describe-db-instances --region <REGION> --query "DBInstances[].[DBInstanceIdentifier,Engine,EnabledCloudwatchLogsExports]"

A DB instance fails if EnabledCloudwatchLogsExports is null or empty, meaning no log type is exported.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon RDS console and select Databases.

  3. Select the DB instance found in the Test Plan and choose Modify.

  4. In the Log exports section, select the log types to publish to CloudWatch Logs (for example Error log or PostgreSQL log).

  5. Choose Continue, then Modify DB instance.

  6. Repeat for each affected DB instance in each region in use.

CLI:

Enable export of a log type (for example error, audit, postgresql or alert, depending on the engine):

aws rds modify-db-instance --region <REGION> --db-instance-identifier <DB_INSTANCE_ID> --cloudwatch-logs-export-configuration '{"EnableLogTypes":["<LOG_TYPE>"]}'

Changes to log exports are applied immediately and do not require a reboot.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon RDS console, select the DB instance and choose Modify.

  3. In the Log exports section, clear the log types that were added.

  4. Choose Continue, then Modify DB instance.

CLI:

aws rds modify-db-instance --region <REGION> --db-instance-identifier <DB_INSTANCE_ID> --cloudwatch-logs-export-configuration '{"DisableLogTypes":["<LOG_TYPE>"]}'

Note: disabling log export removes central visibility of database activity. Logs already in CloudWatch Logs are kept according to the log group retention setting.

Reference