cis-aws-database-11-6

name	cis-aws-database-11.6
description	Ensure Monitoring and Logging is Enabled
category	cis-database
version	2.0.0
author	cyberstrike-official
tags	["cis","aws","database","qldb","ledger","monitoring","logging","cloudwatch","cloudtrail"]
cis_id	11.6
cis_benchmark	CIS AWS Database Services Benchmark v2.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-database-11.1","cis-aws-database-11.5","cis-aws-database-11.7"]
prerequisites	[]
severity_boost	{}

11.6 Ensure Monitoring and Logging is Enabled (Manual)

Description

Enable QLDB's built-in logging to capture important system events and database activity. Monitor the logs for any suspicious activities or errors. Leverage Amazon CloudWatch to collect and analyze logs, set up alarms, and receive notifications for potential security incidents.

Rationale

This helps the individual know what is being logged within the activity and determine what next step they should take to address it.

Impact

Monitoring and logging provides visibility into QLDB operations, enabling detection of unauthorized access, performance issues, and security incidents.

Audit Procedure

Using AWS Console

1. Enable AWS CloudTrail:
   • Sign in to the AWS Management Console at https://console.aws.amazon.com/ with your AWS account credentials.
   • Open the AWS CloudTrail console.
   • Create a new trail or select an existing trail.
   • Configure the trail to capture QLDB API calls and relevant events.
   • Specify the Amazon S3 bucket where the CloudTrail logs will be stored.
   • Enable the trail to start capturing QLDB events.
2. Enable Amazon CloudWatch Logs:
   • Open the Amazon CloudWatch console.
   • Create a new log group or select an existing log group.
   • Configure the log group to receive QLDB logs from CloudTrail.
   • Define the log retention period to retain the logs for the desired duration.
   • Enable CloudWatch Logs to start receiving and storing QLDB logs.
3. Configure Log Metric Filters:
   • In the CloudWatch console, go to the log group that contains the QLDB logs.
   • Define log metric filters to extract specific information or patterns from the logs.
   • Create metric filters based on your monitoring and alerting requirements.
   • Specify the target metric and define the filter patterns to match the desired log events.
4. Create CloudWatch Dashboards and Alarms:
   • Create CloudWatch dashboards to visualize and monitor important QLDB metrics.
   • Customize the dashboard widgets to display relevant log metrics, such as API calls or errors.
   • Set up CloudWatch alarms to trigger notifications or automated actions based on specific thresholds or conditions.
   • Configure alarm actions, such as sending email notifications or invoking AWS Lambda functions, to respond to critical events.
5. Enable EventBridge Integration (Optional):
   • Open the Amazon EventBridge console.
   • Create a new rule or select an existing rule.