Back to Checks
alibabacloud

RDS PostgreSQL instance has log_connections parameter enabled

rds_instance_postgresql_log_connections_enabled
Service: rdsSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:ALIYUN::RDS::DBInstance

Alibaba Cloud RDS PostgreSQL instances should have the log_connections parameter set to on. Enabling this parameter logs each attempted connection to the server, including successful client authentication. This log data is essential for identifying, troubleshooting, and repairing configuration errors, detecting unauthorized access attempts, and supporting security auditing.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

Without connection logging enabled, unauthorized access attempts to the database may go unnoticed, making it difficult to detect brute-force attacks or credential compromise. This gap in visibility impacts the ability to perform security monitoring, incident investigation, and forensic analysis, reducing overall confidentiality assurance.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks rds_instance_postgresql_log_connections_enabled

Recommendation

Enable the log_connections parameter on all PostgreSQL RDS instances to log connection attempts for security monitoring and troubleshooting.

Remediation

CLI

aliyun rds ModifyParameter --DBInstanceId <instance_id> --Parameters "{\"log_connections\":\"on\"}"

Other

1Log on to the **RDS Console**.
2Select the region and target PostgreSQL instance.
3In the left-side navigation pane, select **Parameters**.
4Find the `log_connections` parameter and set it to `on`.
5Click **Apply Changes**.

Check Code

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.rds.rds_client import rds_client


class rds_instance_postgresql_log_connections_enabled(Check):
    """Check if parameter 'log_connections' is set to 'ON' for PostgreSQL Database."""

    def execute(self) -> list[CheckReportAlibabaCloud]:
        findings = []

        for instance in rds_client.instances:
            if "PostgreSQL" in instance.engine:
                report = CheckReportAlibabaCloud(
                    metadata=self.metadata(), resource=instance
                )
                report.region = instance.region
                report.resource_id = instance.id
                report.resource_arn = f"acs:rds:{instance.region}:{rds_client.audited_account}:dbinstance/{instance.id}"

                if instance.log_connections == "on":
                    report.status = "PASS"
                    report.status_extended = f"RDS PostgreSQL Instance {instance.name} has log_connections enabled."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"RDS PostgreSQL Instance {instance.name} has log_connections disabled."

                findings.append(report)

        return findings

References