cis-aws-database-10-5

name	cis-aws-database-10.5
description	Ensure Fine-Grained Access Control is Enabled
category	cis-database
version	2.0.0
author	cyberstrike-official
tags	["cis","aws","database","timestream","time-series","access-control","iam","fine-grained"]
cis_id	10.5
cis_benchmark	CIS AWS Database Services Benchmark v2.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-database-10.4","cis-aws-database-10.6","cis-aws-database-10.7"]
prerequisites	[]
severity_boost	{}

10.5 Ensure Fine-Grained Access Control is Enabled (Manual)

Description

Leverage Timestream's fine-grained access control capabilities to control table or row level access. Define access policies that limit access to specific tables, columns, or rows based on user roles or conditions. Implement data filtering and row-level security to restrict access to sensitive information.

Rationale

This helps by having specific permissions which can be denied due to multiple conditions of the database. This allows the user to control certain aspects of the database.

Impact

This adds an extra layer for users to sign into with their credentials to the database.

Audit Procedure

Using AWS Console

1. Understand Fine-Grained Access Control in Timestream:
   • Familiarize yourself with the concept of fine-grained access control and its benefits in Timestream. Understand that fine-grained access control allows you to control access to specific tables, columns, or rows within Timestream databases.
2. Define Timestream Database and Tables:
   • Create the necessary Timestream databases and tables that will be used for fine-grained access control. Design your database schema and define the tables, columns, and rows that need granular access control.
3. Create IAM Policies for Fine-Grained Access:
   • Access the AWS Management Console and navigate to the IAM service. Define IAM policies that grant or deny permissions for specific Timestream actions, databases, tables, columns, or rows. Leverage Timestream's fine-grained access control policy language to specify the conditions and restrictions for access.
4. Assign IAM Policies to IAM Users, Groups, or Roles:
   • Associate the IAM policies created earlier with the respective IAM users, groups, or roles. Assign the appropriate policies to grant access to specific Timestream databases, tables, columns, or rows. Follow the principle of least privilege and provide only the necessary permissions to users based on their requirements.
5. Test Fine-Grained Access Control:
   • Validate the fine-grained access control settings by attempting different actions on Timestream databases, tables, columns, or rows. Verify that the defined policies accurately restrict or allow access based on the specified conditions. Perform thorough testing to enforce the expected granularity and security level.
6. Regularly Review and Update Access Policies:
   • Periodically review the fine-grained access control policies to ensure they align with your organization's security requirements. Remove any unnecessary or outdated policies. Regularly monitor IAM activity logs and AWS CloudTrail to identify any unauthorized access attempts or unusual activities related to fine-grained access control.