Cis Aws Database 5.9

---
name: cis-aws-database-5.9
description: "Ensure Audit Logging is Enabled"
category: cis-database
version: "2.0.0"
author: cyberstrike-official
tags: [cis, aws, database, elasticache, redis, audit, logging, cloudwatch]
cis_id: "5.9"
cis_benchmark: "CIS AWS Database Services Benchmark v2.0.0"
tech_stack: [aws]
cwe_ids: []
chains_with: [cis-aws-database-5.6]
prerequisites: []
severity_boost: {}
---

# 5.9 Ensure Audit Logging is Enabled

## Description

To manage your enterprise caching solution, it is important that you know how your clusters are performing and the resources they are consuming. It's also important that you know the events that are being generated and the costs of your deployment.

Amazon CloudWatch provides metrics for monitoring your cache performance. In addition, cost allocation tags help you monitor and manage costs.

## Rationale

N/A

## Impact

Reduce the risk of any fraud or inconsistency within the database because only authorized user has access to it.

## Audit Procedure

### Using AWS Console

1. Sign in to the AWS Management Console
   - Sign in to the AWS Management Console at https://console.aws.amazon.com/ with your AWS account credentials.

2. Open the Amazon Keyspaces Console
   - Navigate to the service using the `Find Services` search bar or by directly accessing the console at https://console.aws.amazon.com/keyspaces/.

3. Select Keyspace
   - Choose the Keyspace (database) for which you want to enable audit logging.
   - Click on the Keyspace name to access its details page.

4. Enable Amazon CloudWatch Logs
   - In the Keyspace details page, click on the `Configuration` tab.
   - Under the `Logging` section, locate the `CloudWatch Logs` option.
   - Click on `Edit`.
   - Select the `Enable` option to enable logging for the Keyspace.
   - Choose an existing CloudWatch Logs log group or create a new one to store the logs generated by the Keyspace activities.
   - Click `Save` to enable CloudWatch Logs for the Keyspace.

5. Configure CloudWatch Logs
   - Open the CloudWatch console by navigating to `CloudWatch` in the AWS Management Console.
   - In the left-side menu, click on `Logs`.
   - Create a new log group or select an existing log group that will store the Keyspaces logs.
   - Configure log retention settings based on your retention requirements. Logs can be stored for a specific number of days or indefinitely.
   - Define any necessary log group permissions to control access to the logs.
   - Optionally, set up log exports or alarms for specific log events or patterns if needed.

6. Verify the Logging Status
   - Wait a few minutes for the changes to propagate and the logging configuration to take effect.
   - Refresh the Keyspace details page to see the updated logging status.
   - Verify that CloudWatch Logs is enabled for the Keyspace.

7. Monitor and Analyze Logs
   - Navigate to the CloudWatch console and select the log group that stores the Keyspaces logs.
   - Monitor the logs to gain insights into the activities and operations performed on your Keyspace.
   - Use CloudWatch Logs features, such as log searching, filtering, and visualization, to analyze the logs and identify any security or operational issues.
   - Establish appropriate log monitoring and alerting mechanisms to proactively identify and respond to potential security incidents or operational anomalies.

## Expected Result

CloudWatch Logs is enabled for ElastiCache/Keyspaces, log groups are configured with appropriate retention periods, and logs are being actively monitored.

## Remediation

### Using AWS Console

Follow the same steps as the audit procedure to enable audit logging for ElastiCache clusters.

## Default Value

By default, audit logging is not enabled for ElastiCache/Keyspaces.

## References

1. https://aws.amazon.com/products/databases/

## CIS Controls

| Controls Version | Control                                                    | IG 1 | IG 2 | IG 3 |
| ---------------- | ---------------------------------------------------------- | ---- | ---- | ---- |
| v8               | 8.1 Establish and Maintain an Audit Log Management Process | x    | x    | x    |
| v7               | 6.2 Activate audit logging                                 | x    | x    | x    |

## Profile

Level 1 | Manual