Back to Checks
alibabacloud

RDS instance has SQL auditing enabled

rds_instance_sql_audit_enabled
Service: rdsSeverity: medium
OfficialBuilt-inVerified
Categories:loggingforensics-ready
Resource Type:ALIYUN::RDS::DBInstance

Alibaba Cloud RDS instances should have SQL auditing (SQL Explorer) enabled to track database events in an audit log. This helps maintain regulatory compliance, understand database activity, and detect anomalies indicating security violations. Applies to all RDS engines except SQL Server 2012/2016/2017 and MariaDB TX.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

Without SQL auditing, it is difficult to detect unauthorized access, data breaches, or malicious activity within the database. The absence of audit logs hinders forensic investigations, compliance reporting, and the ability to identify data exfiltration or privilege escalation attempts, impacting confidentiality and integrity.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks rds_instance_sql_audit_enabled

Recommendation

Enable SQL auditing (SQL Explorer) on all applicable RDS instances to track database events and maintain audit logs for security monitoring and compliance.

Remediation

CLI

aliyun rds ModifySQLCollectorPolicy --DBInstanceId <instance_id> --SQLCollectorStatus Enable --StoragePeriod <days>

Other

1Log on to the **RDS Console**.
2Select the target RDS instance.
3In the left-side navigation pane, select **SQL Explorer**.
4Click **Activate Now**.
5Specify the SQL log storage duration.
6Click **Activate**.

Check Code

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.rds.rds_client import rds_client


class rds_instance_sql_audit_enabled(Check):
    """Check if 'Auditing' is set to 'On' for applicable database instances."""

    def execute(self) -> list[CheckReportAlibabaCloud]:
        findings = []

        for instance in rds_client.instances:
            report = CheckReportAlibabaCloud(
                metadata=self.metadata(), resource=instance
            )
            report.region = instance.region
            report.resource_id = instance.id
            report.resource_arn = f"acs:rds:{instance.region}:{rds_client.audited_account}:dbinstance/{instance.id}"

            if instance.audit_log_enabled:
                report.status = "PASS"
                report.status_extended = (
                    f"RDS Instance {instance.name} has SQL audit enabled."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"RDS Instance {instance.name} does not have SQL audit enabled."
                )

            findings.append(report)

        return findings

References