AWS controltower documentation change
Summary
Expanded control CT.RDS.PR.2 to include RDS clusters, updated documentation, and removed specific notes about engine properties and cluster-level management.
Security assessment
The change broadens the scope of an existing security control (enhanced monitoring) to include clusters, improving visibility into database performance metrics. While enhanced monitoring aids security posture by enabling anomaly detection, there is no explicit mention of addressing a specific vulnerability or incident.
Diff
diff --git a/controltower/latest/controlreference/rds-rules.md b/controltower/latest/controlreference/rds-rules.md index 8365e4ae1..4d4d7d7d7 100644 --- a//controltower/latest/controlreference/rds-rules.md +++ b//controltower/latest/controlreference/rds-rules.md @@ -13 +13 @@ CT.RDS.PR.1CT.RDS.PR.2CT.RDS.PR.3CT.RDS.PR.4CT.RDS.PR.5CT.RDS.PR.6CT.RDS.PR.7CT. - * [CT.RDS.PR.2] Require an Amazon RDS database instance to have enhanced monitoring configured + * [CT.RDS.PR.2] Require an Amazon RDS database instance or cluster to have enhanced monitoring configured @@ -360 +360 @@ FAIL Example - Use this template to verify that the control prevents non-complia -## [CT.RDS.PR.2] Require an Amazon RDS database instance to have enhanced monitoring configured +## [CT.RDS.PR.2] Require an Amazon RDS database instance or cluster to have enhanced monitoring configured @@ -362 +362 @@ FAIL Example - Use this template to verify that the control prevents non-complia -This control checks whether enhanced monitoring is activated for an Amazon Relational Database Service (RDS) instance. +This control checks whether enhanced monitoring is activated for Amazon Relational Database Service (RDS) instances. @@ -396,4 +395,0 @@ Enhanced monitoring metrics are useful when you want to see how different proces - * This control applies only when the `Engine` property is provided. It does not apply when restoring from a DB snapshot or cluster snapshot where an `Engine` has not been set explicitly. - - * This control applies to a standalone RDS instance and an RDS instance that is part of a DB Cluster. Do not enable this control if you want to manage enhanced monitoring on the cluster level instead of requiring it to be specified on each RDS DB instance within the cluster. For more information on configuring enahanced monitoring at the cluster level, refer to [Setting up and enabling Enhanced Monitoring](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_Monitoring.OS.Enabling.html) in the _Amazon Aurora User Guide_ -