cis-aws-database-2-5

name	cis-aws-database-2.5
description	Ensure Database Audit Logging is Enabled
category	cis-database
version	2.0.0
author	cyberstrike-official
tags	["cis","aws","database","aurora","logging","audit","cloudtrail","activity-streams"]
cis_id	2.5
cis_benchmark	CIS AWS Database Services Benchmark v2.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-database-2.4"]
prerequisites	[]
severity_boost	{}

2.5 Ensure Database Audit Logging is Enabled (Manual)

Description

Amazon Aurora provides advanced auditing capabilities through AWS CloudTrail and Amazon RDS Database Activity Streams. Here is a step-by-step guide on how to enable and use these features:

Rationale

Allows individuals to access and retrieve their old logs, log their new events, and store their log.

Impact

Without audit logging enabled, it becomes difficult to track database access, detect unauthorized activities, and meet compliance requirements.

Audit Procedure

Using AWS Console

Enabling logging through AWS CloudTrail:

1. Sign in to AWS Management Console

   • If you do not already have an AWS account, you will need to create one at https://aws.amazon.com.

2. Navigate to CloudTrail Dashboard

   • Navigate to the CloudTrail service.
   • You can find this under the Management & Governance category.

3. Create a new trail

   • In the CloudTrail Dashboard, click on Create trail.
   • Provide a name for the trail, and specify the S3 bucket where you want the logs to be stored.

4. Configure trail settings

   • Choose the settings that meet your requirements. For instance, you can log events for all regions, or you can log management events, data events, or both.

5. Create the trail

   • After specifying the trail settings, click Create.

Enabling logging through Amazon Database Activity Streams:

1. Navigate to Amazon RDS Dashboard

   • In the AWS Management Console, navigate to the RDS service.
   • You can find this under the Database category.

2. Choose your Aurora DB instance

   • In the RDS Dashboard, click on Databases, and then click on the name of your Aurora DB instance.

3. Enable Database Activity Streams

   • In the Connectivity & Security tab, find the Database Activity Streams section. Click .