Aurora MySQL clusters should publish audit logs to CloudWatch Logs

문서 > Datadog 보안 > OOTB Rules > Aurora MySQL clusters should publish audit logs to CloudWatch Logs

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Description

This check verifies the Aurora MySQL DB cluster is configured to send audit logs to CloudWatch Logs. This check does not apply to Aurora Serverless v1 DB clusters.

Audit logs capture and record database activities such as login attempts, data changes, schema modifications, and other events related to security and compliance auditing. By configuring an Aurora MySQL DB cluster to send audit logs to a log group in Amazon CloudWatch Logs, you enable real-time analysis of the log data. CloudWatch Logs offers highly durable storage for logs, allowing you to create alerts and monitor metrics in CloudWatch.

Remediation

For an alternate method to publish audit logs to CloudWatch Logs:

Enable advanced auditing, and
Set the cluster-level DB parameter server_audit_logs_upload to 1.

By default, the server_audit_logs_upload parameter is set to 0. Datadog does not recommend using the default setting. Instead, follow the method specified in Publishing Amazon Aurora MySQL logs to Amazon CloudWatch Logs in the Amazon Aurora User Guide.