AWS controltower documentation change
Summary
Narrowed control CT.RDS.PR.2 scope from 'instance or cluster instance' to standalone instances, added implementation guidance
Security assessment
Change clarifies control applicability but doesn't address a specific vulnerability. Enhanced monitoring remains a security best practice, but the modification is primarily about scope definition rather than remediating a security issue. The added note helps implementers avoid conflicts with cluster-level monitoring configurations.
Diff
diff --git a/controltower/latest/controlreference/rds-rules.md b/controltower/latest/controlreference/rds-rules.md index a0c67d35a..8b9b6ea03 100644 --- a//controltower/latest/controlreference/rds-rules.md +++ b//controltower/latest/controlreference/rds-rules.md @@ -13 +13 @@ CT.RDS.PR.1CT.RDS.PR.2CT.RDS.PR.3CT.RDS.PR.4CT.RDS.PR.5CT.RDS.PR.6CT.RDS.PR.7CT. - * [CT.RDS.PR.2] Require an Amazon RDS database instance or cluster instance to have enhanced monitoring configured + * [CT.RDS.PR.2] Require an Amazon RDS database instance to have enhanced monitoring configured @@ -360 +360 @@ FAIL Example - Use this template to verify that the control prevents non-complia -## [CT.RDS.PR.2] Require an Amazon RDS database instance or cluster instance to have enhanced monitoring configured +## [CT.RDS.PR.2] Require an Amazon RDS database instance to have enhanced monitoring configured @@ -362 +362 @@ FAIL Example - Use this template to verify that the control prevents non-complia -This control checks whether enhanced monitoring is activated for Amazon Relational Database Service (RDS) instances. +This control checks whether enhanced monitoring is activated for an Amazon Relational Database Service (RDS) instances. @@ -395,0 +396,2 @@ Enhanced monitoring metrics are useful when you want to see how different proces + * This control applies to a standalone RDS instance and an RDS instance that is part of a DB cluster. Do not enable this control if you want to manage enhanced monitoring on the cluster level instead of requiring it to be specified on each RDS DB instance within the cluster. For more information on configuring enahanced monitoring at the cluster level, refer to [Setting up and enabling Enhanced Monitoring](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_Monitoring.OS.Enabling.html) in the _Amazon Aurora User Guide_. +