cis-aws-database-9-5

name	cis-aws-database-9.5
description	Ensure Audit Logging is Enabled
category	cis-database
version	2.0.0
author	cyberstrike-official
tags	["cis","aws","database","neptune","graph-database","audit-logging","cloudwatch"]
cis_id	9.5
cis_benchmark	CIS AWS Database Services Benchmark v2.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-database-9.4","cis-aws-database-9.6","cis-aws-database-9.7"]
prerequisites	[]
severity_boost	{}

9.5 Ensure Audit Logging is Enabled (Manual)

Description

This control is important because it helps ensure activity within the cluster and identifies who has last modified the document and who has access to it, in case of breaches. It also ensures compliance with regulation requirements.

Rationale

Audit logging captures and records all activities within the Neptune cluster, enabling detection of unauthorized access, compliance verification, and forensic analysis.

Impact

Reduces risks of any fraud since worker activity is being monitored and tracked.

Audit Procedure

Using AWS Console

1. Sign into the AWS Management Console at https://console.aws.amazon.com/ with your AWS account credentials.
2. Open the Amazon Neptune Console - Navigate to the service using the Find Services search bar or by directly accessing the console at https://console.aws.amazon.com/neptune/.
3. Select the Neptune Cluster:
   • Choose the Amazon Neptune cluster on which you want to enable audit logging. Click on the cluster name to access its details page.
4. Enable Amazon CloudWatch Logs:
   • In the cluster details page, navigate to the Monitoring or Logging section.
   • Under CloudWatch Logs, click Enable to enable logging for the Neptune cluster.
   • Select an existing CloudWatch Logs group or create a new one to store the logs.
   • Choose the appropriate retention period for the logs, considering your compliance and retention requirements.
   • Click Save or Apply Changes to enable CloudWatch Logs for the Neptune cluster.
5. Configure Log Levels (Optional):
   • In the cluster details page, navigate to the Configuration or Logging section.
   • Under Logging, you may have the option to configure log levels for different components of Neptune, such as query logs or error logs.
   • Adjust the log levels according to your logging and troubleshooting needs.
   • Click Apply Changes to save the log level configuration.
6. Review and Analyze Logs:
   • Access the Amazon CloudWatch console by navigating to CloudWatch in the AWS Management Console.
   • Go to the CloudWatch Logs section and locate the log group associated with your Neptune cluster.