Back to Checks
alibabacloud

RDS PostgreSQL instance has log_disconnections parameter enabled

rds_instance_postgresql_log_disconnections_enabled
Service: rdsSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:ALIYUN::RDS::DBInstance

Alibaba Cloud RDS PostgreSQL instances should have the log_disconnections parameter set to on. Enabling this parameter logs session terminations and the duration of each session. This data is valuable for identifying abnormal disconnection patterns, troubleshooting performance issues, and supporting security auditing and incident investigation.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

Without disconnection logging, it is harder to track session durations and identify abnormal disconnection patterns that might indicate attacks, session hijacking, or stability issues. This reduces visibility into database activity, impacting security monitoring and the ability to perform effective forensic analysis.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks rds_instance_postgresql_log_disconnections_enabled

Recommendation

Enable the log_disconnections parameter on all PostgreSQL RDS instances to log session terminations for security monitoring and troubleshooting.

Remediation

CLI

aliyun rds ModifyParameter --DBInstanceId <instance_id> --Parameters "{\"log_disconnections\":\"on\"}"

Other

1Log on to the **RDS Console**.
2Select the region and target PostgreSQL instance.
3In the left-side navigation pane, select **Parameters**.
4Find the `log_disconnections` parameter and set it to `on`.
5Click **Apply Changes**.

Check Code

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.rds.rds_client import rds_client


class rds_instance_postgresql_log_disconnections_enabled(Check):
    """Check if parameter 'log_disconnections' is set to 'ON' for PostgreSQL Database."""

    def execute(self) -> list[CheckReportAlibabaCloud]:
        findings = []

        for instance in rds_client.instances:
            if "PostgreSQL" in instance.engine:
                report = CheckReportAlibabaCloud(
                    metadata=self.metadata(), resource=instance
                )
                report.region = instance.region
                report.resource_id = instance.id
                report.resource_arn = f"acs:rds:{instance.region}:{rds_client.audited_account}:dbinstance/{instance.id}"

                if instance.log_disconnections == "on":
                    report.status = "PASS"
                    report.status_extended = f"RDS PostgreSQL Instance {instance.name} has log_disconnections enabled."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"RDS PostgreSQL Instance {instance.name} has log_disconnections disabled."

                findings.append(report)

        return findings

References