Project: KICS (Provisioning / Security & Compliance)
File: 8d7f7b8c-6c7c-40f8-baa6-62006c6c7b56.md

title: RDS Without Logging hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 8d7f7b8c-6c7c-40f8-baa6-62006c6c7b56 Query name: RDS Without Logging Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Observability URL: RDS does not have any kind of logger<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "awsdbinstance" "positive1" { allocated_storage = 5 engine = "postgres" instance_class = "db.t3.small" password = "admin" username = "admin" } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="7" resource "awsdbinstance" "positive2" { allocated_storage = 5 engine = "postgres" instance_class = "db.t3.small" password = "admin" username = "admin" enabledcloudwatchlogs_exports = [] } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="1" module "db" { source = "terraform-aws-modules/rds/aws" version = "~> 3.0" identifier = "demodb" engine = "mysql" engine_version = "5.7.19" instance_class = "db.t2.large" allocated_storage = 5 name = "demodb" username = "user" password = "YourPwdShouldBeLongAndSecure!" port = "3306" iamdatabaseauthentication_enabled = true vpcsecuritygroup_ids = ["sg-12345678"] maintenance_window = "Mon:00:00-Mon:03:00" backup_window = "03:00-06:00" monitoring_interval = "30" monitoringrolename = "MyRDSMonitoringRole" createmonitoringrole = true tags = { Owner = "user" Environment = "dev" } subnet_ids = ["subnet-12345678", "subnet-87654321"] family = "mysql5.7" majorengineversion = "5.7" deletion_protection = true parameters = [ { name = "charactersetclient" value = "utf8mb4" }, { name = "charactersetserver" value = "utf8mb4" } ] options = [ { optionname = "MARIADBAUDIT_PLUGIN" option_settings = [ { name = "SERVERAUDITEVENTS" value = "CONNECT" }, { name = "SERVERAUDITFILE_ROTATIONS" value = "37" }, ] }, ] } ``` <details><summary>Positive test num. 4 - tf file</summary> ```tf hl_lines="11" module "db" { source = "terraform-aws-modules/rds/aws" version = "~> 3.0" identifier = "demodb" engine = "mysql" engine_version = "5.7.19" instance_class = "db.t2.large" allocated_storage = 5 enabledcloudwatchlogs_exports = [] name = "demodb" username = "user" password = "YourPwdShouldBeLongAndSecure!" port = "3306" iamdatabaseauthentication_enabled = true vpcsecuritygroup_ids = ["sg-12345678"] maintenance_window = "Mon:00:00-Mon:03:00" backup_window = "03:00-06:00" monitoring_interval = "30" monitoringrolename = "MyRDSMonitoringRole" createmonitoringrole = true tags = { Owner = "user" Environment = "dev" } subnet_ids = ["subnet-12345678", "subnet-87654321"] family = "mysql5.7" majorengineversion =

deletion_protection = true parameters = [ { name = "charactersetclient" value = "utf8mb4" }, { name = "charactersetserver" value = "utf8mb4" } ] options = [ { optionname = "MARIADBAUDIT_PLUGIN" option_settings = [ { name = "SERVERAUDITEVENTS" value = "CONNECT" }, { name = "SERVERAUDITFILE_ROTATIONS" value = "37" }, ] }, ] } ``` </details> ```tf title="Negative test num. 1 - tf file" resource "awsdbinstance" "negative1" { allocated_storage = 5 engine = "postgres" instance_class = "db.t3.small" password = "admin" username = "admin" enabledcloudwatchlogs_exports = ["upgrade"] } resource "awsdbinstance" "negative2" { allocated_storage = 5 engine = "mariadb" instance_class = "db.t3.small" password = "admin" username = "admin" enabledcloudwatchlogs_exports = ["general", "error"] } ``` ```tf title="Negative test num. 2 - tf file" module "db" { source = "terraform-aws-modules/rds/aws" version = "~> 3.0" identifier = "demodb" engine = "mysql" engine_version = "5.7.19" instance_class = "db.t2.large" allocated_storage = 5 enabledcloudwatchlogs_exports = ["general", "error"] name = "demodb" username = "user" password = "YourPwdShouldBeLongAndSecure!" port = "3306" iamdatabaseauthentication_enabled = true vpcsecuritygroup_ids = ["sg-12345678"] maintenance_window = "Mon:00:00-Mon:03:00" backup_window = "03:00-06:00" monitoring_interval = "30" monitoringrolename = "MyRDSMonitoringRole" createmonitoringrole = true tags = { Owner = "user" Environment = "dev" } subnet_ids = ["subnet-12345678", "subnet-87654321"] family = "mysql5.7" majorengineversion = "5.7" deletion_protection = true parameters = [ { name = "charactersetclient" value = "utf8mb4" }, { name = "charactersetserver" value = "utf8mb4" } ] options = [ { optionname = "MARIADBAUDIT_PLUGIN" option_settings = [ { name = "SERVERAUDITEVENTS" value = "CONNECT" }, { name = "SERVERAUDITFILE_ROTATIONS" value = "37" }, ] }, ] } ``` ```tf title="Negative test num. 3 - tf file" module "db" { source = "terraform-aws-modules/rds/aws" version = "~> 3.0" identifier = "demodb" engine = "mysql" engine_version = "5.7.19" instance_class = "db.t2.large" allocated_storage = 5 enabledcloudwatchlogs_exports = ["upgrade"] name = "demodb" username = "user" password = "YourPwdShouldBeLongAndSecure!" port = "3306" iamdatabaseauthentication_enabled = true vpcsecuritygroup_ids = ["sg-12345678"] maintenance_window = "Mon:00:00-Mon:03:00" backup_window = "03:00-06:00" monitoring_interval = "30" monitoringrolename = "MyRDSMonitoringRole" createmonitoringrole = true tags = { Owner = "user" Environment = "dev" } subnet_ids = ["subnet-12345678", "subnet-87654321"] family = "mysql5.7" majorengineversion = "5.7" deletion_protection = true parameters = [ { name = "charactersetclient" value = "utf8mb4" }, { name = "charactersetserver" value = "utf8mb4" } ] options = [ { optionname = "MARIADBAUDIT_PLUGIN" option_settings = [ { name = "SERVERAUDITEVENTS" value = "CONNECT" }, { name = "SERVERAUDITFILE_ROTATIONS" value = "37" }, ] }, ] } ```