MariaDB Connector

# Create a custom option group with MariaDB Audit Plugin
aws rds create-option-group \
  --option-group-name mariadb-audit-options \
  --engine-name mariadb \
  --major-engine-version 10.6 \
  --option-group-description "MariaDB option group with audit plugin"

# Add the MariaDB Audit Plugin to the option group
aws rds add-option-to-option-group \
  --option-group-name mariadb-audit-options \
  --options "OptionName=MARIADB_AUDIT_PLUGIN,OptionSettings=[\
    {Name=SERVER_AUDIT_LOGGING,Value=ON},\
    {Name=SERVER_AUDIT_EVENTS,Value=CONNECT,QUERY,TABLE},\
    {Name=SERVER_AUDIT_INCL_USERS,Value=},\
    {Name=SERVER_AUDIT_EXCL_USERS,Value=rdsadmin}]"

# Apply the option group to your RDS instance
aws rds modify-db-instance \
  --db-instance-identifier my-mariadb-instance \
  --option-group-name mariadb-audit-options \
  --apply-immediately

# Enable CloudWatch Logs export for MariaDB
aws rds modify-db-instance \
  --db-instance-identifier my-mariadb-instance \
  --cloudwatch-logs-export-configuration '{"EnableLogTypes":["audit","error","slowquery"]}'

# Create a new RDS MariaDB instance with CloudWatch logging enabled
aws rds create-db-instance \
  --db-instance-identifier my-mariadb-instance \
  --db-instance-class db.t3.medium \
  --engine mariadb \
  --engine-version 10.6.14 \
  --master-username admin \
  --manage-master-user-password \
  --allocated-storage 100 \
  --option-group-name mariadb-audit-options \
  --cloudwatch-logs-export-configuration '["audit","error","slowquery"]'

# Disable audit log publishing (if needed)
aws rds modify-db-instance \
  --db-instance-identifier my-mariadb-instance \
  --cloudwatch-logs-export-configuration '{"DisableLogTypes":["audit"]}'

-- Verify the audit plugin is loaded and active
SHOW PLUGINS WHERE Name = 'SERVER_AUDIT';

-- Check current audit settings
SHOW GLOBAL VARIABLES LIKE 'server_audit%';

-- Expected output for properly configured RDS:
-- server_audit_logging          | ON
-- server_audit_events           | CONNECT,QUERY,TABLE
-- server_audit_excl_users       | rdsadmin
-- server_audit_output_type      | file

-- View audit status
SHOW GLOBAL STATUS LIKE 'server_audit%';

-- Check which users are being audited
SELECT @@server_audit_incl_users AS included_users,
       @@server_audit_excl_users AS excluded_users;

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "logs:DescribeLogGroups",
        "logs:DescribeLogStreams",
        "logs:GetLogEvents",
        "logs:FilterLogEvents"
      ],
      "Resource": [
        "arn:aws:logs:*:*:log-group:/aws/rds/instance/*/audit:*",
        "arn:aws:logs:*:*:log-group:/aws/rds/instance/*/error:*",
        "arn:aws:logs:*:*:log-group:/aws/rds/instance/*/slowquery:*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "rds:DescribeDBInstances",
        "rds:DescribeDBLogFiles",
        "rds:DownloadDBLogFilePortion"
      ],
      "Resource": "*"
    }
  ]
}

# DB Audit configuration for RDS MariaDB via CloudWatch
databases:
  - name: production-rds-mariadb
    type: mariadb

    # RDS endpoint
    host: my-mariadb-instance.xxxx.us-east-1.rds.amazonaws.com
    port: 3306
    database: your_database
    username: dbaudit_reader
    password: ${RDS_MARIADB_PASSWORD}

    # SSL is enabled by default for RDS
    ssl: true
    ssl_mode: VERIFY_IDENTITY

    options:
      # Use CloudWatch as the log source
      log_source: cloudwatch

      # CloudWatch configuration
      cloudwatch:
        region: us-east-1
        log_group: /aws/rds/instance/my-mariadb-instance/audit

        # AWS credentials (use IAM role if running on EC2/ECS)
        # access_key_id: ${AWS_ACCESS_KEY_ID}
        # secret_access_key: ${AWS_SECRET_ACCESS_KEY}

        # Or use IAM role (recommended)
        use_iam_role: true

      # Polling interval for CloudWatch logs
      polling_interval: 30

# View audit logs in CloudWatch Logs Insights
# Log group: /aws/rds/instance/<instance-id>/audit

# Query for failed login attempts
fields @timestamp, @message
| filter @message like /FAILED_CONNECT|Access denied/
| sort @timestamp desc
| limit 100

# Query for DDL operations
fields @timestamp, @message
| filter @message like /CREATE|DROP|ALTER|TRUNCATE/
| sort @timestamp desc
| limit 100

# Query for specific user activity
fields @timestamp, @message
| filter @message like /,dbaudit_reader,/
| sort @timestamp desc
| limit 50

# Query for queries on specific tables
fields @timestamp, @message
| filter @message like /customers|orders|payments/
| sort @timestamp desc
| limit 100