Monitor Amazon Aurora for instances without encryption - AWS Prescriptive Guidance
SummaryPrerequisites and limitationsArchitectureToolsEpicsRelated resourcesAttachments

Monitor Amazon Aurora for instances without encryption

Created by Mansi Suratwala (AWS)

Environment: Production

Technologies: Databases; Security, identity, compliance; Storage & backup

Workload: Open-source; All other workloads

AWS services: Amazon SNS; Amazon Aurora; AWS CloudTrail; Amazon CloudWatch; AWS Lambda

Summary

This pattern provides an Amazon Web Services (AWS) CloudFormation template that you can deploy to set up automatic notifications when an Amazon Aurora instance is created without encryption turned on.

Aurora is a fully managed relational database engine that's compatible with MySQL and PostgreSQL. With some workloads, Aurora can deliver up to five times the throughput of MySQL and up to three times the throughput of PostgreSQL without requiring changes to most of your existing applications.

The CloudFormation template creates an Amazon CloudWatch Events event and an AWS Lambda function. The event uses AWS CloudTrail to monitor for any Aurora instance creation or a point in time restoration of an existing instance. The Cloudwatch Events event initiates the Lambda function, which checks whether encryption is enabled. If encryption is not turned on, the Lambda function sends an Amazon Simple Notification Service (Amazon SNS) notification informing you of the violation. 

Prerequisites and limitations

Prerequisites 

  • An active AWS account

Limitations 

  • This service control works with Amazon Aurora instances only. It does not support other Amazon Relational Database Service (Amazon RDS) instances.

  • The CloudFormation template must be deployed for CreateDBInstance and RestoreDBClusterToPointInTime only. 

Product versions

  • PostgreSQL versions that are supported in Amazon Aurora

  • MySQL versions that are supported in Amazon Aurora

Architecture

Target technology stack  

  • Amazon Aurora

  • AWS CloudTrail

  • Amazon CloudWatch

  • AWS Lambda

  • Amazon Simple Storage Service (Amazon S3)

  • Amazon SNS

Target architecture 

Aurora launch without encryption invoking CloudTrail, CloudWatch Events, Lambda, and an SNS message.

Automation and scale

You can use the CloudFormation template multiple times for different Regions and accounts. You need to run it only once in each Region or account.

Tools

Tools

  • Amazon Aurora – Amazon Aurora is a fully managed relational database engine that's compatible with MySQL and PostgreSQL.

  • AWS CloudTrail – AWS CloudTrail helps you manage governance, compliance, and operational and risk auditing of your AWS account. Actions taken by a user, a role, or an AWS service are recorded as events in CloudTrail. 

  • Amazon CloudWatch Events – Amazon CloudWatch Events delivers a near-real-time stream of system events that describe changes in AWS resources. 

  • AWS Lambda – AWS Lambda is a compute service that supports running code without provisioning or managing servers. Lambda runs your code only when needed and scales automatically, from a few requests per day to thousands per second. 

  • Amazon S3 – Amazon Simple Storage Service (Amazon S3) is a highly scalable object storage service that you can use for a wide range of storage solutions, including websites, mobile applications, backups, and data lakes.

  • Amazon SNS – Amazon Simple Notification Service (Amazon SNS) is a managed service that provides message delivery using Lambda, HTTP, email, mobile push notifications, and mobile text messages (SMS). 

Code 

A .zip file of the project is available as an attachment.

Epics

TaskDescriptionSkills required

Define the S3 bucket.

Open the Amazon S3 console, and choose or create an S3 bucket. This S3 bucket will host the Lambda code .zip file. Your S3 bucket needs to be in the same Region as Aurora. The S3 bucket name cannot contain leading slashes.

Cloud architect
TaskDescriptionSkills required

Upload the Lambda code.

Upload the Lambda code .zip file provided in the Attachments section to the S3 bucket that you defined.

Cloud architect
TaskDescriptionSkills required

Deploy the CloudFormation template.

On the CloudFormation console, deploy the RDS_Aurora_Encryption_At_Rest.yml CloudFormation template that's provided as an attachment to this pattern. In the next epic, provide values for the template parameters.

Cloud architect
TaskDescriptionSkills required

Provide the S3 bucket name.

Enter the name of the S3 bucket that you created or chose in the first epic.

Cloud architect

Provide the S3 key.

Provide the location of the Lambda code .zip file in your S3 bucket, without leading slashes (for example, <directory>/<file-name>.zip).

Cloud architect

Provide an email address.

Provide an active email address to receive Amazon SNS notifications.

Cloud architect

Define the logging level.

Define the logging level and frequency for your Lambda function. Info designates detailed informational messages on the application’s progress. Error designates error events that could still allow the application to continue running. Warning designates potentially harmful situations.

Cloud architect
TaskDescriptionSkills required

Confirm the subscription.

When the template successfully deploys, it sends a subscription email message to the email address provided. To receive notifications, you must confirm this email subscription. 

Cloud architect

Related resources

Attachments

To access additional content that is associated with this document, unzip the following file: attachment.zip