Back to Checks
alibabacloud

Log monitoring and alerts are set up for RDS instance configuration changes

sls_rds_instance_configuration_changes_alert_enabled
Service: slsSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:ALIYUN::SLS::Alert

Alibaba Cloud SLS should have an alarm configured for RDS Instance configuration changes. By directing ActionTrail logs to SLS with alert rules, database configuration modifications are monitored in real time. This ensures changes to security parameters, network settings, or access controls are promptly detected.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

Without monitoring for RDS configuration changes, unauthorized modifications may go undetected, leading to security misconfigurations such as enabling public access or disabling encryption. Delayed detection increases risk of data breaches, unauthorized database access, and service disruption, compromising confidentiality and integrity of stored data.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks sls_rds_instance_configuration_changes_alert_enabled

Recommendation

  1. Log on to the SLS Console
  2. Ensure ActionTrail is enabled
  3. Select Alerts
  4. Ensure alert rule has been enabled for RDS instance configuration changes

Remediation

CLI

aliyun sls create-alert --project <project-name> --alert-name rds-config-changes --alert-displayname 'RDS Instance Configuration Changes Alert' --condition 'event.serviceName: Rds and (event.eventName: ModifyDBInstanceSpec or event.eventName: ModifySecurityIps or event.eventName: ModifyDBInstanceNetworkType)' --dashboard <dashboard-name> --schedule '{"type":"FixedRate","interval":"1m"}'

Other

1Log on to the **SLS Console**.
2Ensure **ActionTrail** is enabled and delivering logs to a **Log Service** project.
3Navigate to the project receiving ActionTrail logs.
4Select **Alerts** and click **Create Alert Rule**.
5Configure the query to filter for RDS configuration changes: `event.serviceName: Rds and (event.eventName: ModifyDBInstanceSpec or event.eventName: ModifySecurityIps or event.eventName: ModifyDBInstanceNetworkType)`.
6Set the alert **schedule**, **notification method**, and **severity**.
7Save and enable the alert rule.

Check Code

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.sls.sls_client import sls_client


class sls_rds_instance_configuration_changes_alert_enabled(Check):
    def execute(self) -> list[CheckReportAlibabaCloud]:
        findings = []
        found = False

        for alert in sls_client.alerts:
            query_list = alert.configuration.get("queryList", [])
            if not query_list:
                continue

            for query_obj in query_list:
                query = query_obj.get("query", "")
                if "rds" in query and (
                    "ModifyHASwitchConfig" in query
                    or "ModifyDBInstanceHAConfig" in query
                    or "SwitchDBInstanceHA" in query
                    or "ModifyDBInstanceSpec" in query
                    or "MigrateSecurityIPMode" in query
                    or "ModifySecurityIps" in query
                    or "ModifyDBInstanceSSL" in query
                    or "MigrateToOtherZone" in query
                    or "UpgradeDBInstanceKernelVersion" in query
                    or "UpgradeDBInstanceEngineVersion" in query
                    or "ModifyDBInstanceMaintainTime" in query
                    or "ModifyDBInstanceAutoUpgradeMinorVersion" in query
                    or "AllocateInstancePublicConnection" in query
                    or "ModifyDBInstanceConnectionString" in query
                    or "ModifyDBInstanceNetworkExpireTime" in query
                    or "ReleaseInstancePublicConnection" in query
                    or "SwitchDBInstanceNetType" in query
                    or "ModifyDBInstanceNetworkType" in query
                    or "ModifyDTCSecurityIpHostsForSQLServer" in query
                    or "ModifySecurityGroupConfiguration" in query
                    or "CreateBackup" in query
                    or "ModifyBackupPolicy" in query
                    or "DeleteBackup" in query
                    or "CreateDdrInstance" in query
                    or "ModifyInstanceCrossBackupPolicy" in query
                ):
                    found = True
                    report = CheckReportAlibabaCloud(
                        metadata=self.metadata(), resource=alert
                    )
                    report.status = "PASS"
                    report.status_extended = f"SLS Alert {alert.name} is configured for RDS instance configuration changes."
                    report.resource_id = alert.name
                    report.resource_arn = alert.arn
                    report.region = alert.region
                    findings.append(report)
                    break

            if found:
                break

        if not found:
            report = CheckReportAlibabaCloud(
                metadata=self.metadata(), resource=sls_client.provider.identity
            )
            report.status = "FAIL"
            report.status_extended = (
                "No SLS Alert configured for RDS instance configuration changes."
            )
            report.resource_id = sls_client.audited_account
            report.resource_arn = sls_client.provider.identity.identity_arn
            report.region = sls_client.region
            findings.append(report)

        return findings

References