Checks

Ensure that Huawei Cloud Relational Database Service (RDS) instances have storage disk encryption enabled using a Key Management Service (KMS) key.

RDS DB instances are evaluated for Enhanced Monitoring being enabled, which publishes real-time OS-level metrics (CPU, memory, disk, network) to CloudWatch Logs for each instance.

RDS event subscriptions for DB parameter groups notify on configuration change events (or all categories) when the subscription is enabled

RDS event subscriptions are evaluated for database security group events. The check expects an enabled subscription with source type db-security-group that includes the configuration change and failure event categories.

RDS DB instances are evaluated for enrollment in Amazon RDS Extended Support. The check fails if EngineLifecycleSupportis set to open-source-rds-extended-support, indicating the instance will incur additional charges after standard support ends.

RDS DB instances using MySQL, MariaDB, or PostgreSQL engines (including Aurora variants) have IAM database authentication enabled at the instance level or, when part of a cluster, evaluated for cluster-level enablement.

RDS DB instances are assessed for VPC placement by the presence of a vpc_id indicating deployment within a VPC.

Instances without this association are treated as outside VPC networking.

RDS DB instances are configured to publish database logs to CloudWatch Logs (e.g., error, general, slowquery, audit).

The evaluation identifies instances that have log exports enabled to a CloudWatch log group.

RDS DB instances are evaluated for the auto_minor_version_upgrade setting that enables automatic minor engine updates during maintenance windows.

RDS DB instances are evaluated for Multi-AZ configuration, either enabled on the instance or inherited from the associated DB cluster.

RDS DB instances are evaluated for use of a port that differs from the engine's default. Matching an engine with its default port-3306 (MySQL/MariaDB/Aurora MySQL), 5432 (PostgreSQL/Aurora), 1521 (Oracle), 1433 (SQL Server), 50000 (Db2)-indicates the instance uses the default listener.

RDS DB instances are assessed for internet exposure using the PubliclyAccessible setting, security group ingress to the DB port from any address, and whether subnets are public. Instances that combine an internet-facing endpoint, open ingress, and public subnets are identified.

Alibaba Cloud RDS instances should only accept connections from trusted networks and IP addresses. This check verifies that the IP whitelist does not contain entries such as 0.0.0.0/0 or 0.0.0.0 that would allow access from anywhere on the internet. Only specific, trusted IP addresses should be whitelisted to minimize the attack surface of the database server.

Alibaba Cloud RDS PostgreSQL instances should have the log_connections parameter set to on. Enabling this parameter logs each attempted connection to the server, including successful client authentication. This log data is essential for identifying, troubleshooting, and repairing configuration errors, detecting unauthorized access attempts, and supporting security auditing.

Alibaba Cloud RDS PostgreSQL instances should have the log_disconnections parameter set to on. Enabling this parameter logs session terminations and the duration of each session. This data is valuable for identifying abnormal disconnection patterns, troubleshooting performance issues, and supporting security auditing and incident investigation.

Alibaba Cloud RDS PostgreSQL instances should have the log_duration parameter set to on. Enabling this parameter logs the duration of each completed SQL statement, generating query and error logs that can be used to identify slow queries, troubleshoot performance issues, and detect potential denial-of-service patterns targeting the database.

RDS DB instances (non-Aurora) are included in an AWS Backup plan, indicating scheduled backups and retention are applied to the resource.

Aurora engines are evaluated separately.

Alibaba Cloud RDS instances should have SQL auditing (SQL Explorer) enabled to track database events in an audit log. This helps maintain regulatory compliance, understand database activity, and detect anomalies indicating security violations. Applies to all RDS engines except SQL Server 2012/2016/2017 and MariaDB TX.

Alibaba Cloud RDS instances with SQL auditing enabled should have a retention period configured to be greater than or equal to the required minimum (default: 6 months / 180 days). Audit logs are essential for checking anomalies, understanding database activity, and gaining insight into suspected breaches or misuse of information and access.

Alibaba Cloud RDS instances should enforce SSL encryption for all incoming connections. SSL protects data in transit between the application and the database, preventing interception of sensitive data such as credentials, database queries, and query outputs. This check verifies that SSL encryption is enabled on the RDS instance.

RDS DB instances are assessed for KMS-based encryption at rest (StorageEncrypted=true), covering instance storage and derived artifacts such as snapshots, automated backups, and read replicas.

Alibaba Cloud RDS instances should have Transparent Data Encryption (TDE) enabled. TDE performs real-time encryption and decryption of the database, associated backups, and log files at rest, without requiring changes to the application. This check verifies that TDE is enabled to protect sensitive data stored in the RDS instance from unauthorized physical access.

Alibaba Cloud RDS instances with TDE enabled should use a customer-managed key (BYOK) rather than a service-managed key. BYOK provides increased transparency and control over the encryption key lifecycle, enhanced security through an HSM-backed KMS service, and promotes separation of duties between the data owner and the cloud provider.

RDS DB instances and DB clusters enforce SSL/TLS for client connections via parameter groups. The check looks for rds.force_ssl=1 (PostgreSQL, SQL Server) or require_secure_transport enabled (MySQL-family) and identifies databases where encryption enforcement isn't active.