Description

Ensure that every Amazon Redshift provisioned cluster has database audit logging enabled. Audit logging records connection attempts, changes to database users and, optionally, the queries run on the database, and delivers these logs to an Amazon S3 bucket or to Amazon CloudWatch Logs.

Rationale

Without audit logs, malicious logins, unauthorized user or permission changes and suspicious queries can go unnoticed. There is also no evidence available for forensic analysis and incident response. Enabling audit logging, storing the logs in a protected destination with controlled access and retention, and alerting on unusual connections or queries improves detection and supports investigations.

Impact

  • Provides a record of connections, user changes and database activity for security monitoring and investigations

  • Helps meet audit and compliance requirements

  • S3 storage or CloudWatch Logs ingestion and storage are charged

  • Logging the queries run on the database (user activity log) also requires the enable_user_activity_logging parameter to be set to true in the cluster parameter group

Default Value

Audit logging is disabled by default for Amazon Redshift provisioned clusters.

Pre-Requisites

  • IAM permissions: redshift:DescribeClusters, redshift:DescribeLoggingStatus, redshift:EnableLogging and redshift:DisableLogging

  • When logging to Amazon S3: a bucket in the same region as the cluster, using Amazon S3 managed encryption (SSE-S3), with a bucket policy that allows Amazon Redshift to write to it

  • When logging to CloudWatch Logs: no extra setup is needed; Redshift creates the log groups automatically

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon Redshift console and select Clusters.

  3. Select a cluster and open the Properties tab.

  4. Check that audit logging is shown as enabled, with an S3 bucket or CloudWatch as the destination.

  5. Repeat for each cluster in each region in use.

  6. If audit logging is disabled, follow the implementation steps.

CLI:

List the clusters:

aws redshift describe-clusters --region <REGION> --query "Clusters[].ClusterIdentifier"

Show the audit logging status of a cluster:

aws redshift describe-logging-status --region <REGION> --cluster-identifier <CLUSTER_ID> --query "[LoggingEnabled,LogDestinationType,BucketName,LogExports]"

A cluster fails if LoggingEnabled is false.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon Redshift console and select Clusters.

  3. Select the cluster found in the Test Plan and open the Properties tab.

  4. Open the audit logging settings for editing.

  5. Turn on audit logging and choose the destination:

    • CloudWatch: select the log types to export (connection log, user log, user activity log), or

    • S3 bucket: select an existing bucket and optionally enter a prefix.

  6. Choose Save changes.

  7. Repeat for each affected cluster in each region in use.

CLI:

Enable audit logging to an S3 bucket:

aws redshift enable-logging --region <REGION> --cluster-identifier <CLUSTER_ID> --bucket-name <S3_BUCKET_NAME>

Or enable audit logging to CloudWatch Logs:

aws redshift enable-logging --region <REGION> --cluster-identifier <CLUSTER_ID> --log-destination-type cloudwatch --log-exports connectionlog userlog useractivitylog

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon Redshift console and select the cluster.

  3. In the Properties tab, open the audit logging settings for editing.

  4. Turn off audit logging and choose Save changes.

CLI:

aws redshift disable-logging --region <REGION> --cluster-identifier <CLUSTER_ID>

Note: disabling audit logging removes visibility of database connections and activity. Logs already delivered are kept in the S3 bucket or CloudWatch Logs.

Reference