Rule: RDS DB Instance and Cluster Enhanced Monitoring Enabled

The rule states that the Enhanced Monitoring feature should be enabled for Amazon RDS (Relational Database Service) DB instances and clusters in order to comply with the NIST Cybersecurity Framework (CSF) v1. Enhanced Monitoring provides deeper insights into the performance and resource utilization of RDS instances, helping to identify potential security or operational issues.

Enabling Enhanced Monitoring for RDS DB instances and clusters ensures the availability, integrity, and confidentiality of the data stored within the database. It allows for better detection and response to incidents, improving overall security posture and reducing the risk of potential security breaches.

Ensure that the AWS region where your RDS instances and clusters are deployed supports Enhanced Monitoring. You can refer to the AWS Regional Services List (https://aws.amazon.com/about-aws/global-infrastructure/regional-product-services/) to verify service availability.

Make sure that the IAM user or role used to manage RDS instances and clusters has the necessary permissions to enable and configure Enhanced Monitoring. The required permissions include

rds:EnableEnhancedMonitoring

rds:DescribeDBInstances

Confirm that your RDS instance's database engine version is compatible with Enhanced Monitoring. Not all database engine versions support this feature. Refer to the AWS documentation for the specific database engine you are using to check its compatibility with Enhanced Monitoring.

Ensure that you have the correct RDS instance identifier or cluster identifier for the instance or cluster where you want to enable Enhanced Monitoring. You will need this identifier when executing the necessary commands or APIs.

Before proceeding, make sure you have the AWS Command Line Interface (CLI) installed and properly configured with the necessary credentials.

To enable Enhanced Monitoring for an RDS DB instance using the AWS CLI, execute the following command:

• <instance_identifier>

  : Replace this with the identifier of the RDS DB instance you want to enable Enhanced Monitoring for.

• <interval>

  : Replace this with the desired monitoring interval (in seconds). Valid values are

  0

  (disabling monitoring),

  1

  ,

  5

  ,

  10

  ,

  15

  ,

  30

  ,

  60

  ,

  120

  , and

  180

  .

To enable Enhanced Monitoring for an RDS cluster using the AWS CLI, execute the following command:

• <cluster_identifier>

  : Replace this with the identifier of the RDS cluster you want to enable Enhanced Monitoring for.

• <engine_mode>

  : Replace this with the engine mode of the RDS cluster (e.g.,

  parallelquery

  ,

  multimaster

  ).
• Note: The

  --cloudwatch-log-exports

  parameter with the value

  '["db"]'

  ensures the monitoring data is exported to CloudWatch.

Follow these steps to enable Enhanced Monitoring for RDS DB instances and clusters:

Following the troubleshooting steps and using the necessary codes, you can enable the Enhanced Monitoring feature for your RDS DB instances and clusters. This ensures compliance with the NIST Cybersecurity Framework (CSF) v1 and provides valuable insights into the performance and security of your database environment.