cis-aws-database-7-6

name	cis-aws-database-7.6
description	Ensure Audit Logging is Enabled
category	cis-database
version	2.0.0
author	cyberstrike-official
tags	["cis","aws","database","documentdb","logging","audit","cloudwatch"]
cis_id	7.6
cis_benchmark	CIS AWS Database Services Benchmark v2.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-database-7.8","cis-aws-database-7.11"]
prerequisites	[]
severity_boost	{}

7.6 Ensure Audit Logging is Enabled (Manual)

Description

Enable audit logging to capture database activities, including login attempts, queries, and modifications. Send the logs to Amazon CloudWatch or a centralized log management system for analysis and monitoring.

Rationale

It captures and saves logs of activities that took place in the cluster, by recording login attempts, queries, and any changes within the database.

Impact

Enabling audit logging provides visibility into database activities, helping detect unauthorized access attempts, compliance violations, and security incidents.

Audit Procedure

Using AWS Console

1. Sign into the AWS Management Console

   • Sign into the AWS Management Console at https://console.aws.amazon.com/ with your AWS account credentials.

2. Open the Amazon DocumentDB Console

   • Navigate to the service using the Find Services search bar or by directly accessing the console at https://console.aws.amazon.com/docdb/.

3. Select the DocumentDB Cluster

   • Choose the Amazon DocumentDB cluster for which you want to enable audit logging.
   • Click on the cluster name to access its details page.
   • In the cluster details page, navigate to the "Configuration" section.

4. Enable Audit Logging

   • Under the Database options or Database features section.
   • Click on the Edit button or Modify option to configure the audit logging settings.
   • Enable the option for audit logging by choosing the appropriate setting.
   • Specify the destination for the audit logs, which can be an Amazon CloudWatch Logs group or an Amazon S3 bucket.

5. Configure Audit Log Destination

   • If you choose to send audit logs to an Amazon CloudWatch Logs group, select the existing group or create a new one.
   • If you choose to send audit logs to an Amazon S3 bucket, select the existing bucket or create a new one. Provide the necessary permissions for DocumentDB to write logs to the bucket.

6. Set Audit Log Retention Period

   • Specify the retention period for the audit logs, indicating how long the logs should be retained in the selected destination.
   • Consider your compliance and regulatory requirements when determining the retention period.