- 필수 기능
- 앱 내
- 서비스 관리
- 인프라스트럭처
- 애플리케이션 성능
- 디지털 경험
- 소프트웨어 제공
- 보안
- 로그 관리
- 관리
- 인프라스트럭처
- ci
- containers
- csm
- ndm
- otel_guides
- overview
- slos
- synthetics
- tests
- 워크플로
Detect a user attempting to exfiltrate data from an RDS Snapshot.
This rule lets you monitor ModifyDBClusterSnapshotAttribute CloudTrail API calls to detect when an RDS snapshot is made public or shared with an AWS account.
This rule also inspects the:
@requestParameters.valuesToAdd
array to determine if the string all
is contained. This is the indicator which means the RDS snapshot is made public.@requestParameters.attributeName
array to determine if the string restore
is contained. This is the indicator which means the RDS snapshot was shared with a new or unknown AWS Account.{{@userIdentity.arn}}
intended to make the RDS snaphsot public.11 October 2022 - Updated severity.