Back to Checks
alibabacloud

RDS instance SQL audit retention period meets the configured minimum

rds_instance_sql_audit_retention
Service: rdsSeverity: medium
OfficialBuilt-inVerified
Categories:loggingforensics-ready
Resource Type:ALIYUN::RDS::DBInstance

Alibaba Cloud RDS instances with SQL auditing enabled should have a retention period configured to be greater than or equal to the required minimum (default: 6 months / 180 days). Audit logs are essential for checking anomalies, understanding database activity, and gaining insight into suspected breaches or misuse of information and access.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

Short retention periods for audit logs can result in the loss of critical forensic data needed for incident investigation, compliance auditing, and regulatory reporting. Many regulations and security frameworks require minimum retention periods for audit data, and failing to meet them can result in non-compliance penalties.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks rds_instance_sql_audit_retention

Recommendation

Configure the SQL audit retention period to at least 180 days (6 months) on all RDS instances to ensure adequate audit log availability for compliance and forensic purposes.

Remediation

CLI

aliyun rds ModifySQLCollectorPolicy --DBInstanceId <instance_id> --SQLCollectorStatus Enable --StoragePeriod 180

Other

1Log on to the **RDS Console**.
2Select the target RDS instance.
3In the left-side navigation pane, select **SQL Explorer**.
4Click **Service Setting**.
5Enable `Activate SQL Explorer` if not already active.
6Set the storage duration to `6 months` or longer.
7Click **OK** to save changes.

Check Code

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.rds.rds_client import rds_client


class rds_instance_sql_audit_retention(Check):
    """Check if 'Auditing' Retention is greater than the configured period."""

    def execute(self) -> list[CheckReportAlibabaCloud]:
        findings = []

        # Get configurable max days from audit config (default: 180 days - 6 months)
        min_audit_retention_days = rds_client.audit_config.get(
            "min_rds_audit_retention_days", 180
        )

        for instance in rds_client.instances:
            report = CheckReportAlibabaCloud(
                metadata=self.metadata(), resource=instance
            )
            report.region = instance.region
            report.resource_id = instance.id
            report.resource_arn = f"acs:rds:{instance.region}:{rds_client.audited_account}:dbinstance/{instance.id}"

            if (
                instance.audit_log_enabled
                and instance.audit_log_retention >= min_audit_retention_days
            ):
                report.status = "PASS"
                report.status_extended = f"RDS Instance {instance.name} has SQL audit enabled with retention of {instance.audit_log_retention} days (>= {min_audit_retention_days} days)."
            elif instance.audit_log_enabled:
                report.status = "FAIL"
                report.status_extended = f"RDS Instance {instance.name} has SQL audit enabled but retention is {instance.audit_log_retention} days (< {min_audit_retention_days} days)."
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"RDS Instance {instance.name} does not have SQL audit enabled."
                )

            findings.append(report)

        return findings

References