cis-aws-database-9-4

name	cis-aws-database-9.4
description	Ensure Authentication and Access Control is Enabled
category	cis-database
version	2.0.0
author	cyberstrike-official
tags	["cis","aws","database","neptune","graph-database","iam","authentication","access-control"]
cis_id	9.4
cis_benchmark	CIS AWS Database Services Benchmark v2.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-database-9.1","cis-aws-database-9.5","cis-aws-database-9.6"]
prerequisites	[]
severity_boost	{}

9.4 Ensure Authentication and Access Control is Enabled (Manual)

Description

This helps ensure that there are specific IAM roles and policies that are given the necessary information within a Neptune DB cluster to operate as needed.

Rationale

IAM authentication and access control verifies the identity of users and services, ensuring only authorized entities can access Neptune resources.

Impact

Allowing authentication verifies the identity of the person and who has appropriate access to a company's data.

Audit Procedure

Using AWS Console

1. Sign into the AWS Management Console at https://console.aws.amazon.com/ with your AWS account credentials.
2. Open the Amazon Neptune Console - Navigate to the service using the Find Services search bar or by directly accessing the console at https://console.aws.amazon.com/neptune/.
3. Select the Neptune Cluster:
   • Choose the Amazon Neptune cluster on which you want to implement authentication and access control.
   • Click on the cluster name to access its details page.
4. Enable IAM Database Authentication:
   • In the cluster details page, navigate to the Configuration or Database Authentication section.
   • Under Database Authentication, select the option to enable IAM database authentication.
   • Click Apply Changes to enable IAM database authentication for the Neptune cluster.
5. Configure IAM Roles and Policies:
   • Open the AWS Identity and Access Management (IAM) console by navigating to IAM in the AWS Management Console.
   • Create IAM roles and policies that define the desired access control for your Neptune resources.
   • Assign the necessary permissions to the IAM roles to allow specific actions on the Neptune cluster, such as read, write, or manage operations.
   • Associate the IAM roles with the appropriate users, groups, or AWS services that need access to the Neptune cluster.
6. Test IAM Database Authentication:
   • Update your client applications or tools to use IAM database authentication when connecting to the Neptune cluster.
   • Configure your applications to assume the necessary IAM roles before establishing a connection to Neptune.
   • Test the connection from your client application to the Neptune cluster to verify that IAM database authentication is working as expected.
   • Ensure that users or services are authenticated and authorized based on the IAM roles and policies defined.