Control: 2.15 Ensure log monitoring and alerts are set up for RDS instance configuration changes
Description
It is recommended that a metric filter and alarm be established for RDS Instance configuration changes.
Remediation
Perform the following to ensure the log monitoring and alerts are set up for RDS instance configuration changes:
From Console
- Logon to SLS Console.
- Click
Log Service Audit Servicein the navigation pane. - Go to
Access to Cloud Products > Global Configurationpage.- Select a location of project for logs.
- Check the
Action Trailand configure a proper days. - Click
Saveto save the changes.
- Go to
Access to Cloud Products > Global ConfigurationsclickCentral Project. - Select
Log Management > Actiontrail Log. - In the search/analytics console, input below query
"event.serviceName": rds and ("event.eventName": ModifyHASwitchConfig or "event.eventName": ModifyDBInstanceHAConfig or "event.eventName": SwitchDBInstanceHA or "event.eventName": ModifyDBInstanceSpec or "event.eventName": MigrateSecurityIPMode or "event.eventName": ModifySecurityIps or "event.eventName": ModifyDBInstanceSSL or "event.eventName": MigrateToOtherZone or "event.eventName": UpgradeDBInstanceKernelVersion or "event.eventName": UpgradeDBInstanceEngineVersion or "event.eventName": ModifyDBInstanceMaintainTime or "event.eventName": ModifyDBInstanceAutoUpgradeMinorVersion or "event.eventName": AllocateInstancePublicConnection or "event.eventName": ModifyDBInstanceConnectionString or "event.eventName": ModifyDBInstanceNetworkExpireTime or "event.eventName": ReleaseInstancePublicConnection or "event.eventName": SwitchDBInstanceNetType or "event.eventName": ModifyDBInstanceNetworkType or "event.eventName": ModifyDBInstanceSSL or "event.eventName": ModifyDTCSecurityIpHostsForSQLServer or "event.eventName": ModifySecurityGroupConfiguration or "event.eventName": CreateBackup or "event.eventName": ModifyBackupPolicy or "event.eventName": DeleteBackup or "event.eventName": CreateDdrInstance or "event.eventName":ModifyInstanceCrossBackupPolicy) | select count(1) as cnt
- Create a dashboard and set alert for the query result.
Usage
Run the control in your terminal:
powerpipe control run alicloud_compliance.control.cis_v100_2_15Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run alicloud_compliance.control.cis_v100_2_15 --shareSQL
This control uses a named query:
select 'arn:acs:::' || account_id as resource, 'info' as status, 'Manual verification required.' as reason , account_id as account_idfrom alicloud_account;