Back to Checks
alibabacloud

RDS PostgreSQL instance has log_duration parameter enabled

rds_instance_postgresql_log_duration_enabled
Service: rdsSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:ALIYUN::RDS::DBInstance

Alibaba Cloud RDS PostgreSQL instances should have the log_duration parameter set to on. Enabling this parameter logs the duration of each completed SQL statement, generating query and error logs that can be used to identify slow queries, troubleshoot performance issues, and detect potential denial-of-service patterns targeting the database.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

Without duration logging, it is difficult to identify slow queries, performance bottlenecks, and potential DoS attempts against the database. This lack of visibility impacts the ability to optimize database performance and detect malicious activity such as resource exhaustion attacks, reducing overall availability assurance.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks rds_instance_postgresql_log_duration_enabled

Recommendation

Enable the log_duration parameter on all PostgreSQL RDS instances to log SQL statement durations for performance monitoring and security analysis.

Remediation

CLI

aliyun rds ModifyParameter --DBInstanceId <instance_id> --Parameters "{\"log_duration\":\"on\"}"

Other

1Log on to the **RDS Console**.
2Select the region and target PostgreSQL instance.
3In the left-side navigation pane, select **Parameters**.
4Find the `log_duration` parameter and set it to `on`.
5Click **Apply Changes**.

Check Code

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.rds.rds_client import rds_client


class rds_instance_postgresql_log_duration_enabled(Check):
    """Check if parameter 'log_duration' is set to 'ON' for PostgreSQL Database."""

    def execute(self) -> list[CheckReportAlibabaCloud]:
        findings = []

        for instance in rds_client.instances:
            if "PostgreSQL" in instance.engine:
                report = CheckReportAlibabaCloud(
                    metadata=self.metadata(), resource=instance
                )
                report.region = instance.region
                report.resource_id = instance.id
                report.resource_arn = f"acs:rds:{instance.region}:{rds_client.audited_account}:dbinstance/{instance.id}"

                if instance.log_duration == "on":
                    report.status = "PASS"
                    report.status_extended = f"RDS PostgreSQL Instance {instance.name} has log_duration enabled."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"RDS PostgreSQL Instance {instance.name} has log_duration disabled."

                findings.append(report)

        return findings

References