cis-aws-database-4-6

name	cis-aws-database-4.6
description	Ensure DynamoDB Streams and AWS Lambda for Automated Compliance Checking is Enabled
category	cis-database
version	2.0.0
author	cyberstrike-official
tags	["cis","aws","database","dynamodb","streams","lambda","compliance","automation"]
cis_id	4.6
cis_benchmark	CIS AWS Database Services Benchmark v2.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-database-4.7"]
prerequisites	[]
severity_boost	{}

4.6 Ensure DynamoDB Streams and AWS Lambda for Automated Compliance Checking is Enabled

Description

Enabling DynamoDB Streams and integrating AWS Lambda allows you to automate compliance checking and perform actions based on changes made to your DynamoDB data.

Rationale

Enabling the DynamoDB with AWS Lambda allows the individual to either use an existing or create a new execution role that allows Lambda to access DynamoDB and write logs.

Impact

N/A

Audit Procedure

Using AWS Console

1. Open DynamoDB Console

   • Sign in to the AWS Management Console and open the DynamoDB console at https://console.aws.amazon.com/dynamodb/.

2. Create or Select a DynamoDB Table

   • You can create a new DynamoDB table or select an existing one to enable DynamoDB Streams.

3. Enable DynamoDB Streams

   • In the DynamoDB console, select your table.
   • Click on the Overview tab.
   • Under the DynamoDB Streams section, click on Manage stream.
   • In the Manage stream dialog, choose Enable and select the desired view type (e.g., New and old images).
   • Click Enable.

4. Create an AWS Lambda Function

   • Open the AWS Management Console and navigate to the Lambda service at https://console.aws.amazon.com/lambda/.
   • Click Create function to create a new Lambda function.
   • Choose a function name, runtime (e.g., Node.js, Python), and other basic settings.
   • Under Permissions, choose an existing or create a new execution role that allows Lambda to access DynamoDB and write logs.
   • Click Create function to create the Lambda function.

5. Configure AWS Lambda with DynamoDB Stream

   • Scroll down to the Designer section in the Lambda function editor.
   • Click on Add trigger.
   • Select DynamoDB from the trigger list.
   • In the Configure triggers dialog, choose the DynamoDB table and the stream that you enabled in the previous step.
   • Define the batch size and starting position, if applicable.