cis-aws-database-6-3

name	cis-aws-database-6.3
description	Ensure Authentication and Access Control is Enabled
category	cis-database
version	2.0.0
author	cyberstrike-official
tags	["cis","aws","database","memorydb","redis","authentication","acl","access-control"]
cis_id	6.3
cis_benchmark	CIS AWS Database Services Benchmark v2.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-database-6.1","cis-aws-database-6.2","cis-aws-database-6.5"]
prerequisites	[]
severity_boost	{}

6.3 Ensure Authentication and Access Control is Enabled (Manual)

Description

Ensure that authentication and access control are enabled for Amazon MemoryDB for Redis clusters to restrict access to authorized users only.

Rationale

Users should select whether they like to enable authentication. If they want to authenticate a password would be required, which would only allow the authorized person to access the cluster. Defining access control allows specific workers in a business access to the database.

Impact

Allowing authentication verifies the identity of the person and who has appropriate access to a company's data.

Audit Procedure

Using AWS Console

1. Sign into the AWS Management Console

   • Sign into the AWS Management Console at https://console.aws.amazon.com/ with your AWS account credentials.

2. Open the Amazon MemoryDB Console

   • Navigate to the service using the Find Services search bar or by directly accessing the console at https://console.aws.amazon.com/memorydb/.

3. Select the Cluster

   • Choose the Amazon MemoryDB cluster on which you want to implement authentication and access control.
   • Click on the cluster name to access its details page.

4. Enable Authentication

   • In the cluster details page, navigate to the Authentication section.
   • Click on Modify to edit the authentication settings.
   • Select the desired authentication option:
     • No Authentication: This option allows unauthenticated access to your MemoryDB cluster.
     • Password Authentication: Choose this option to enable password-based authentication. Enter the desired password for the cluster.
   • Click Apply Changes to enable authentication for the MemoryDB cluster.

5. Define Access Control Policies

   • In the cluster details page, navigate to the "Access Control" section.
   • Click on Modify to edit the access control settings.
   • Define the access control policies based on your requirements:
     • For Redis-based clusters, you can use Redis Access Control Lists (ACLs) to control access at the Redis command level.
     • Use the Redis commands to create, modify, or delete ACL rules as needed.
     • You can define rules based on IP addresses, users, or patterns to allow or deny specific commands or operations.