RDS Cluster log capture is disabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_324
Category - Subcategory	Logging - Disabled or missing
Provider	AWS
Severity	MEDIUM
Framework	Terraform, Terraform Plan

Impact

This rule is inspecting for the activation of log capture on RDS Clusters in AWS. Log capture is crucial for efficient diagnostics, security review and audit. It allows administrators to monitor activities and events that occur in the RDS clusters by capturing log data. If log capture is not enabled, it may compromise the ability to effectively troubleshoot issues or identify malicious activities, leaving the system vulnerable.

How to Fix

Resource: aws_rds_cluster

• Arguments: enabled_cloudwatch_logs_exports

To fix the issue, you should enable log exports for RDS cluster.

The above Terraform code captures all RDS Cluster logs using the "enabled_cloudwatch_logs_exports" argument. It makes the logs ("audit", "error", "general", "slowquery", "postgresql") available in CloudWatch Logs, making it secure and compliant with Cortex Cloud APPSEC_AWS_324 rule. [source,go]

resource "aws_rds_cluster" "default" { engine = "aurora-postgresql" backup_retention_period = 5 preferred_backup_window = "07:00-09:00" enable_http_endpoint = true master_username = "foo" master_password = "bar" skip_final_snapshot = true

enabled_cloudwatch_logs_exports = ["audit", "error", "general", "slowquery", "postgresql"] }