Question 1

Is availability_zones enforced for Registry?

Accepted Answer

Yes, This control checks whether high availability is enabled for your RDS DB clusters. RDS DB clusters should be configured for multiple Availability Zones to ensure availability of the data that is stored.

Question 2

Is backtrack_window enforced for Registry?

Accepted Answer

Yes, This control checks whether AWS Aurora clusters have backtracking enabled. Backups help you to recover more quickly from a security incident. They also strengthen the resilience of your systems. Aurora backtracking reduces the time to recover a database to a point in time. It does not require a database restore to so.

Question 3

Is cloudwatch_log_group_kms_key_id enforced for Registry?

Accepted Answer

Yes, To help protect sensitive data at rest, ensure encryption is enabled for your AWS CloudWatch Log Group.

Question 4

Is cloudwatch_log_group_retention_in_days enforced for Registry?

Accepted Answer

Yes, Ensure a minimum duration of event log data is retained for your log groups to help with troubleshooting and forensics investigations.

Question 5

Is cluster_monitoring_interval enforced for Registry?

Accepted Answer

Yes, Enable AWS Relational Database Service (AWS RDS) to help monitor AWS RDS availability. This provides detailed visibility into the health of your AWS RDS database instances.

Question 6

Is deletion_protection enforced for Registry?

Accepted Answer

Yes, This control checks whether RDS clusters have deletion protection enabled. This control is intended for RDS DB instances. However, it can also generate findings for Aurora DB instances, Neptune DB instances, and AWS DocumentDB clusters. If these findings are not useful,then you can suppress them.

Question 7

Is iam_database_authentication_enabled enforced for Registry?

Accepted Answer

Yes, Checks if an AWS RDS Cluster has AWS Identity and Access Management (IAM) authentication enabled. The rule is non-compliant if an RDS Cluster does not have IAM authentication enabled.

Question 8

Is master_username enforced for Registry?

Accepted Answer

Yes, This control checks whether an AWS RDS database cluster has changed the admin username from its default value. This rule will fail if the admin username is set to the default value.

AWS RDS Aurora Terraform module

Terraform Module Source