cis-aws-database-3-9

name	cis-aws-database-3.9
description	Ensure Monitoring and Logging is Enabled
category	cis-database
version	2.0.0
author	cyberstrike-official
tags	["cis","aws","database","rds","monitoring","logging","cloudwatch","audit"]
cis_id	3.9
cis_benchmark	CIS AWS Database Services Benchmark v2.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-database-3.11"]
prerequisites	[]
severity_boost	{}

3.9 Ensure Monitoring and Logging is Enabled (Manual)

Description

This control ensures that monitoring and logging are enabled for Amazon RDS instances to detect, investigate, and respond to security events and operational issues.

Rationale

Monitoring and logging provide visibility into database activity, enabling detection of unauthorized access, performance issues, and security incidents.

Impact

If the individual is not monitoring and logging their activity it allows the attacker to attack the system and extract or destroy data.

Audit Procedure

Using AWS Console

1. Sign into the AWS Management Console

   • Sign into the AWS Management Console at https://console.aws.amazon.com/ with your AWS account credentials.

2. Open the Amazon RDS Console

   • Navigate to the service using the Find Services search bar or by directly accessing the console at https://console.aws.amazon.com/rds/.

3. Select the RDS Instance

   • Choose the Amazon RDS instance you want to enable monitoring and logging.
   • Click on the instance name to access its details page.
   • In the instance details page, navigate to the Configuration or Monitoring & Logs section.

4. Enable Enhanced Monitoring

   • Under the Monitoring section.
   • Click on the Modify button or Edit option to enable enhanced monitoring.
   • Choose the desired monitoring granularity (1-minute or 5-minute intervals) and the retention period for the monitoring data.
   • Click Continue or Save to apply the changes.

5. Enable Enhanced Logging

   • Under the Logs or Monitoring & Logs section.
   • Click on the Modify button or Edit option to enable enhanced logging.
   • Choose the desired log types to enable, such as general, error, slow query, or audit logs.
   • Configure the log file retention period based on your needs.
   • Select the destination for the logs, such as Amazon CloudWatch Logs or an Amazon S3 bucket.
   • Configure the log format and other settings if applicable.