Control: 45 Aurora MySQL DB clusters should have audit logging enabled
Description
This control checks whether an Amazon Aurora MySQL DB cluster has audit logging enabled. The control fails if the DB parameter group associated with the DB cluster is not in sync, the server_audit_logging parameter is not set to 1, or the server_audit_events parameter is set to an empty value.
Database logs can assist with security and access audits and help diagnose availability issues. Audit logs capture a record of database activity, including login attempts, data modifications, schema changes, and other events that can be audited for security and compliance purposes.
Remediation
For information about enabling logging for an Amazon Aurora MySQL DB cluster, see Publishing Amazon Aurora MySQL logs to Amazon CloudWatch Logs in the Amazon Aurora User Guide.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.foundational_security_rds_45Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.foundational_security_rds_45 --shareSQL
This control uses a named query:
with pg_with_audit_logging_enabled as ( select pg.name, pg.account_id, pg.region from aws_rds_db_cluster as c, aws_rds_db_cluster_parameter_group as pg, jsonb_array_elements(parameters) as p where pg.name = c.db_cluster_parameter_group and pg.account_id = c.account_id and pg.region = c.region and p ->> 'ParameterName' = 'server_audit_logging' and p ->> 'ParameterValue' = '1')select arn as resource, case when engine <> 'aurora-mysql' then 'skip' when p.name is not null then 'ok' else 'alarm' end as status, case when engine <> 'aurora-mysql' then title || ' is not Aurora MySQL-compatible edition.' when p.name is not null then title || ' audit logging enabled.' else title || ' audit logging disabled.' end as reason , i.region, i.account_idfrom aws_rds_db_cluster as i left join pg_with_audit_logging_enabled as p on p.name = i.db_cluster_parameter_group and p.account_id = i.account_id and p.region = i.region;