Cis AWS Database 9.5

9.5 Ensure Audit Logging is Enabled (Manual)

Description

This control is important because it helps ensure activity within the cluster and identifies who has last modified the document and who has access to it, in case of breaches. It also ensures compliance with regulation requirements.

Rationale

Audit logging captures and records all activities within the Neptune cluster, enabling detection of unauthorized access, compliance verification, and forensic analysis.

Impact

Reduces risks of any fraud since worker activity is being monitored and tracked.

Audit Procedure

Using AWS Console

1. Sign into the AWS Management Console at https://console.aws.amazon.com/ with your AWS account credentials.
2. Open the Amazon Neptune Console - Navigate to the service using the Find Services search bar or by directly accessing the console at https://console.aws.amazon.com/neptune/.
3. Select the Neptune Cluster:
   • Choose the Amazon Neptune cluster on which you want to enable audit logging. Click on the cluster name to access its details page.
4. Enable Amazon CloudWatch Logs:
   • In the cluster details page, navigate to the Monitoring or Logging section.
   • Under CloudWatch Logs, click Enable to enable logging for the Neptune cluster.
   • Select an existing CloudWatch Logs group or create a new one to store the logs.
   • Choose the appropriate retention period for the logs, considering your compliance and retention requirements.
   • Click Save or Apply Changes to enable CloudWatch Logs for the Neptune cluster.
5. Configure Log Levels (Optional):
   • In the cluster details page, navigate to the Configuration or Logging section.
   • Under Logging, you may have the option to configure log levels for different components of Neptune, such as query logs or error logs.
   • Adjust the log levels according to your logging and troubleshooting needs.
   • Click Apply Changes to save the log level configuration.
6. Review and Analyze Logs:
   • Access the Amazon CloudWatch console by navigating to CloudWatch in the AWS Management Console.
   • Go to the CloudWatch Logs section and locate the log group associated with your Neptune cluster.
   • Select the log group and review the logs generated by Neptune.
   • Analyze the logs for troubleshooting, performance monitoring, or auditing purposes.
7. Set Up Log Metric Filters and Alarms (Optional):
   • In the CloudWatch console, navigate to Metric Filters in the left-side menu.
   • Click on Create metric filter to set up filters to extract specific information from the Neptune logs.
   • Define the filter patterns to capture the desired log events and extract the required metrics.
   • Configure alarms based on the extracted metrics to trigger notifications or automated actions when specific conditions are met.
8. Regularly Monitor Logs:
   • Continuously monitor the logs generated by Neptune using the CloudWatch Logs console or programmatically using the CloudWatch APIs.
   • Review the logs regularly to identify any abnormal or suspicious activities.
   • Set up appropriate notifications or alerts to proactively respond to critical log events.

Expected Result

CloudWatch Logs should be enabled for the Neptune cluster with appropriate log levels, retention periods, and monitoring alarms configured.

Remediation

Using AWS Console

Follow the audit steps above to enable CloudWatch Logs and configure audit logging for your Neptune cluster.

Default Value

Audit logging is not enabled by default for Neptune clusters.

References

1. https://aws.amazon.com/products/databases/

CIS Controls

Profile

Level 1 | Manual