Cis Aws Database 7.6

---
name: cis-aws-database-7.6
description: "Ensure Audit Logging is Enabled"
category: cis-database
version: "2.0.0"
author: cyberstrike-official
tags: [cis, aws, database, documentdb, logging, audit, cloudwatch]
cis_id: "7.6"
cis_benchmark: "CIS AWS Database Services Benchmark v2.0.0"
tech_stack: [aws]
cwe_ids: []
chains_with: [cis-aws-database-7.8, cis-aws-database-7.11]
prerequisites: []
severity_boost: {}
---

# 7.6 Ensure Audit Logging is Enabled (Manual)

## Description

Enable audit logging to capture database activities, including login attempts, queries, and modifications. Send the logs to Amazon CloudWatch or a centralized log management system for analysis and monitoring.

## Rationale

It captures and saves logs of activities that took place in the cluster, by recording login attempts, queries, and any changes within the database.

## Impact

Enabling audit logging provides visibility into database activities, helping detect unauthorized access attempts, compliance violations, and security incidents.

## Audit Procedure

### Using AWS Console

1. Sign into the AWS Management Console
   - Sign into the AWS Management Console at https://console.aws.amazon.com/ with your AWS account credentials.

2. Open the Amazon DocumentDB Console
   - Navigate to the service using the `Find Services` search bar or by directly accessing the console at https://console.aws.amazon.com/docdb/.

3. Select the DocumentDB Cluster
   - Choose the Amazon DocumentDB cluster for which you want to enable audit logging.
   - Click on the cluster name to access its details page.
   - In the cluster details page, navigate to the "Configuration" section.

4. Enable Audit Logging
   - Under the `Database options` or `Database features` section.
   - Click on the `Edit` button or `Modify` option to configure the audit logging settings.
   - Enable the option for audit logging by choosing the appropriate setting.
   - Specify the destination for the audit logs, which can be an Amazon CloudWatch Logs group or an Amazon S3 bucket.

5. Configure Audit Log Destination
   - If you choose to send audit logs to an Amazon CloudWatch Logs group, select the existing group or create a new one.
   - If you choose to send audit logs to an Amazon S3 bucket, select the existing bucket or create a new one. Provide the necessary permissions for DocumentDB to write logs to the bucket.

6. Set Audit Log Retention Period
   - Specify the retention period for the audit logs, indicating how long the logs should be retained in the selected destination.
   - Consider your compliance and regulatory requirements when determining the retention period.

7. Save the Configuration
   - Click on the `Save` button to apply the audit logging configuration. DocumentDB will start recording audit logs according to the configured settings.

8. Validate Audit Logging
   - Perform operations on your DocumentDB cluster to generate audit log events.
   - Verify that the audit logs are recorded and sent to the specified destination.
   - Review the logs to ensure they contain the expected information and events.

9. Monitor and Analyze Audit Logs
   - Use Amazon CloudWatch Logs or other log analysis tools to monitor and analyze the audit logs generated by DocumentDB.
   - Set up log metrics, alarms, and notifications to detect unusual activities or security incidents.
   - Review audit logs regularly to identify potential security threats, compliance violations, or unauthorized access attempts.

## Expected Result

Audit logging is enabled for all DocumentDB clusters with logs being sent to CloudWatch Logs or S3, with appropriate retention periods configured.

## Remediation

### Using AWS Console

Follow the audit procedure steps to enable audit logging for each DocumentDB cluster. Configure the cluster parameter group to enable audit logging by setting `audit_logs` to `enabled`.

## Default Value

Audit logging is not enabled by default for Amazon DocumentDB.

## References

1. https://aws.amazon.com/products/databases/

## CIS Controls

| Controls Version | Control                                                    | IG 1 | IG 2 | IG 3 |
| ---------------- | ---------------------------------------------------------- | ---- | ---- | ---- |
| v8               | 8.1 Establish and Maintain an Audit Log Management Process | X    | X    | X    |
| v7               | 6.2 Activate audit logging                                 | X    | X    | X    |

## Profile

Level 1 | Manual