GuardDuty RDS Protection should be enabled
Description
This control checks whether GuardDuty RDS Protection is enabled. For a standalone account, the control fails if GuardDuty RDS Protection is disabled. In a multi-account environment, the control fails if the delegated GuardDuty administrator account and all member accounts do not have RDS Protection enabled. RDS Protection in GuardDuty analyzes and profiles RDS login activity for potential access threats to your Amazon Aurora databases (Aurora MySQL-Compatible Edition and Aurora PostgreSQL-Compatible Edition). This feature allows you to identify potentially suspicious login behavior. RDS Protection doesn't require additional infrastructure and is designed so as not to affect the performance of your database instances.
Remediation
To enable GuardDuty RDS Protection, you need to configure the RDS Protection settings in GuardDuty.
Steps
- Navigate to the Amazon GuardDuty console
- Go to 'Settings' in the left navigation
- Select 'RDS Protection'
- Enable 'RDS Protection'
- Configure the protection settings as needed
- Save the configuration
- Verify that RDS Protection is active