Accenture MDR Quick Start Guide for Amazon Web Service Relational Database Service (AWS RDS)

This quick start guide will help Accenture MDR customers configure AWS RDS to collect logs to the Log collection Platform (LCP).

This document includes the following topics: 

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal.

Port Requirements

Table 1-1: Port requirements for LCP communication.

Configuring AWS RDS

Pre-requisites:

An AWS account that you can sign in to.

A user who's a Global Administrator or RDS Administrator.

Device Configuration Steps:

1. If you have an existing database in AWS, select the database and click on Modify and then go to Log Export.

Open

Note: Above screenshot is applicable for MariaDB, MySQL Community, AWS Aurora MySQL database. In the case of AWS Aurora PostgreSQL and PostgreSQL, log type will as follows.

Open

In the case of AWS Microsoft SQL Server, log type will be as follows,

2. Once you save the configuration, Navigate to CloudWatch > Logs to see the logs getting collected. The newly created Log Groups will automatically be created once the logs are getting shipped through the instance.

3. Incase of a new database, while creating a database go to Additional Configuration.

4. Select all types to publish logs to Amazon Cloudwatch.

Note: Above screenshot is applicable for MariaDB, MySQL Community, AWS Aurora MySQL database. In the case of AWS Aurora PostgreSQL and PostgreSQL, log type will as follows

In the case of AWS Microsoft SQL Server, log type will be as follows,

5. Once you save the configuration, Navigate to CloudWatch > Logs to see the logs getting collected. The newly created Log Groups will automatically be created once the logs are getting shipped through the instance

6. Please refer below page to check required IAM user policies.

Accenture MDR Quick Start Guide in Configuring IAM User and KMS Key Policies

7. Below are the URL details which we need to allow for connectivity (Please identify URLs by referring AWS document according to your services and regions):

IAM: For any logging source IAM URL should be allowed

https://docs.aws.amazon.com/general/latest/gr/iam-service.html

Cloudwatch: For cloudwatch logging source, cloudwatch URL should be allowed.

https://docs.aws.amazon.com/general/latest/gr/cwl_region.html

For additional reference

For engine-specific information, see the following:

• Publishing MariaDB logs to Amazon CloudWatch Logs

• Publishing MySQL logs to Amazon CloudWatch Logs

• Publishing Oracle logs to Amazon CloudWatch Logs

• Publishing PostgreSQL logs to Amazon CloudWatch Logs

• Publishing SQL Server logs to Amazon CloudWatch Logs

LCP Configuration Parameters

MxDR supports log collection using role based access control (RBAC) or access key ID and secret method.

• To create access key ID and secret please refer

• To support log collection using RBAC please refer

Table 1-2: AWS RDS generic event collector (API - 3908) properties to be configured by MDR are given in the table.