Log Exports Should Be Enabled

More Info:

Amazon RDS sends general, slow query, audit and error logs from your MySQL, Aurora and MariaDB databases to AWS CloudWatch Logs. Broadcasting these logs to CloudWatch allows you to maintain continuous visibility into database activity, query performance and errors within your RDS database instances.

Risk Level

Low

Address

Operational Maturity, Reliability, Security

Compliance Standards

• APRA CPS 234 (Australia)
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• DPDPA
• Digital Operational Resilience Act (EU)
• Essential 8
• HITRUST CSF
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST CSF
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• PCI
• Reserve Bank of India (RBI) Cyber Security Framework
• SOC2
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the misconfiguration of log exports not being enabled for an AWS RDS instance, you can follow these steps using the AWS Management Console:

1. Login to AWS Console: Go to the AWS Management Console (https://aws.amazon.com/console/) and log in to your account.

2. Navigate to RDS Service: Click on the “Services” dropdown menu at the top left corner of the console. Under the “Database” section, click on “RDS” to open the Amazon Relational Database Service dashboard.

3. Select the RDS Instance: From the list of RDS instances, select the instance for which you want to enable log exports by clicking on its name.

4. Enable Enhanced Monitoring: In the RDS instance dashboard, scroll down to the “Logs & events” section. Click on the “Modify” button.

5. Enable Log Exports: In the “Modify DB instance” page, scroll down to the “Monitoring & logging” section. Check the box next to “Enhanced monitoring” to enable it.

6. Configure Log Exports: Under the “Enhanced monitoring” section, you can configure the log types that you want to export. Select the log types (e.g., slow query logs, audit logs) that you want to export.

7. Save Changes: Scroll down to the bottom of the page and click on the “Continue” button. Review the changes you have made, and click on the “Modify DB instance” button to save the changes.

8. Verify Log Exports: Once the changes are saved, AWS will start exporting the selected logs from your RDS instance. You can verify the log exports by checking the log destination you have configured (e.g., CloudWatch Logs).

By following these steps, you have successfully remediated the misconfiguration of log exports not being enabled for your AWS RDS instance.

Using CLI

To remediate the misconfiguration of enabling log exports for AWS RDS using AWS CLI, follow these step-by-step instructions:

1. Enable Enhanced Logging: First, enable Enhanced Logging for your RDS instance. This will allow you to export the logs to CloudWatch Logs.

   aws rds modify-db-instance --db-instance-identifier YOUR_DB_INSTANCE_IDENTIFIER --enable-enhanced-monitoring --monitoring-role-arn YOUR_CLOUDWATCH_ROLE_ARN --monitoring-interval YOUR_INTERVAL
   

   Replace YOUR_DB_INSTANCE_IDENTIFIER with the identifier of your RDS instance, YOUR_CLOUDWATCH_ROLE_ARN with the ARN of the IAM role that has permission to write logs to CloudWatch Logs, and YOUR_INTERVAL with the interval at which logs should be sent to CloudWatch Logs.

2. Configure Log Exports: Next, configure the log exports for your RDS instance. You can specify which logs you want to export (error, slow query, general logs, etc.).

   aws rds modify-db-instance --db-instance-identifier YOUR_DB_INSTANCE_IDENTIFIER --cloudwatch-logs-export-configuration '{"EnableLogTypes":["audit","error","general","slowquery"],"DisableLogTypes":[]}'
   

   Replace YOUR_DB_INSTANCE_IDENTIFIER with the identifier of your RDS instance. In the EnableLogTypes array, specify the types of logs you want to export.

3. Verify Configuration: You can verify that the log exports are enabled for your RDS instance by describing the instance.

   aws rds describe-db-instances --db-instance-identifier YOUR_DB_INSTANCE_IDENTIFIER
   

   This command will provide detailed information about your RDS instance, including the log export configuration.

By following these steps, you can remediate the misconfiguration of enabling log exports for your AWS RDS instance using AWS CLI.

Using Python

To enable log exports for AWS RDS using Python, you can use the AWS SDK for Python (Boto3). Here are the step-by-step instructions to remediate this misconfiguration:

1. Install Boto3: If you haven’t already installed Boto3, you can install it using pip:

   pip install boto3
   

2. Configure AWS Credentials: Make sure you have your AWS credentials configured either through environment variables, shared credentials file, or IAM role.

3. Use the following Python script to enable log exports for AWS RDS:

import boto3

def enable_rds_log_exports(instance_identifier, log_types):
    rds_client = boto3.client('rds')
    
    try:
        response = rds_client.modify_db_instance(
            DBInstanceIdentifier=instance_identifier,
            EnableCloudwatchLogsExports=log_types
        )
        print(f"Log exports enabled for RDS instance {instance_identifier}")
    except Exception as e:
        print(f"Error enabling log exports: {str(e)}")

# Specify the RDS instance identifier and the log types to enable
instance_identifier = 'your_rds_instance_identifier'
log_types = ['error', 'general', 'slowquery']  # Specify the log types you want to export

enable_rds_log_exports(instance_identifier, log_types)

4. Replace 'your_rds_instance_identifier' with the actual identifier of your RDS instance and update the log_types list with the specific log types you want to export (e.g., error, general, slowquery).

5. Run the Python script to enable log exports for the specified RDS instance.

After running the script, log exports will be enabled for the specified RDS instance with the specified log types. Make sure to review the IAM permissions associated with the AWS credentials used to run the script to ensure they have the necessary permissions to modify RDS instances.

Using Terraform

resource "aws_db_instance" "MYSQL_RDS_INSTANCE" {
  # Replace MYSQL_RDS_INSTANCE with your DB instance resource name
  # and ensure the rest of the configuration matches your existing setup.
  allocated_storage    = 20
  engine               = "mysql"
  engine_version       = "ENGINE_VERSION"
  instance_class       = "db.t3.micro"
  identifier           = "DB_INSTANCE_IDENTIFIER"
  username             = "DB_USERNAME"
  password             = "DB_PASSWORD"
  db_subnet_group_name = aws_db_subnet_group.DB_SUBNET_GROUP.name

  # This argument configures which logs are exported to CloudWatch.
  # It REPLACES any existing log export configuration, so include
  # all logs you want to keep enabled, including currently enabled ones.
  enabled_cloudwatch_logs_exports = [
    "audit",
    "error",
    "general",
    "slowquery",
    # Add any other currently enabled log types here if applicable.
  ]

  # Set to true if you want the change applied immediately (may cause a brief outage).
  # Leaving this as false (or omitting it) defers the change to the next maintenance window.
  apply_immediately = false

  # ...other required arguments for your instance...
}

Changing enabled_cloudwatch_logs_exports does not force replacement of the DB instance, but it does overwrite the existing log export set; verify that the listed log types are supported for your engine and that all currently enabled logs are included.

To verify, terraform plan should show an in-place update on aws_db_instance.MYSQL_RDS_INSTANCE with enabled_cloudwatch_logs_exports changing from its current value to ["audit", "error", "general", "slowquery", ...] and (optionally) apply_immediately set as configured.

Additional Reading:

• https://aws.amazon.com/about-aws/whats-new/2018/01/now-publish-log-files-from-amazon-rds-for-mysql-and-mariadb-to-amazon-cloudwatch-logs/