AWS controltower documentation change
Summary
Narrowed control CT.RDS.PR.2 scope from 'database instance or cluster' to specifically 'database instance', updated documentation to clarify enhanced monitoring applies to standalone instances and instances in clusters, added guidance about cluster-level management
Security assessment
Change clarifies security configuration requirements for enhanced monitoring but does not address a specific vulnerability. Enhanced monitoring is a security best practice but the change itself is scope clarification rather than patching a security issue.
Diff
diff --git a/controltower/latest/controlreference/rds-rules.md b/controltower/latest/controlreference/rds-rules.md index 23d21b80f..8365e4ae1 100644 --- a//controltower/latest/controlreference/rds-rules.md +++ b//controltower/latest/controlreference/rds-rules.md @@ -13 +13 @@ CT.RDS.PR.1CT.RDS.PR.2CT.RDS.PR.3CT.RDS.PR.4CT.RDS.PR.5CT.RDS.PR.6CT.RDS.PR.7CT. - * [CT.RDS.PR.2] Require an Amazon RDS database instance or cluster to have enhanced monitoring configured + * [CT.RDS.PR.2] Require an Amazon RDS database instance to have enhanced monitoring configured @@ -360 +360 @@ FAIL Example - Use this template to verify that the control prevents non-complia -## [CT.RDS.PR.2] Require an Amazon RDS database instance or cluster to have enhanced monitoring configured +## [CT.RDS.PR.2] Require an Amazon RDS database instance to have enhanced monitoring configured @@ -362 +362 @@ FAIL Example - Use this template to verify that the control prevents non-complia -This control checks whether enhanced monitoring is activated for Amazon Relational Database Service (RDS) instances. +This control checks whether enhanced monitoring is activated for an Amazon Relational Database Service (RDS) instance. @@ -397,0 +398,2 @@ Enhanced monitoring metrics are useful when you want to see how different proces + * This control applies to a standalone RDS instance and an RDS instance that is part of a DB Cluster. Do not enable this control if you want to manage enhanced monitoring on the cluster level instead of requiring it to be specified on each RDS DB instance within the cluster. For more information on configuring enahanced monitoring at the cluster level, refer to [Setting up and enabling Enhanced Monitoring](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_Monitoring.OS.Enabling.html) in the _Amazon Aurora User Guide_ +