MySQL Connector

# Create a custom option group for MariaDB Audit Plugin
aws rds create-option-group \
  --option-group-name mysql-audit-options \
  --engine-name mysql \
  --major-engine-version 8.0 \
  --option-group-description "MySQL option group with MariaDB Audit Plugin"

# Add the MariaDB Audit Plugin to the option group
aws rds add-option-to-option-group \
  --option-group-name mysql-audit-options \
  --options "OptionName=MARIADB_AUDIT_PLUGIN,OptionSettings=[{Name=SERVER_AUDIT_LOGGING,Value=ON},{Name=SERVER_AUDIT_EVENTS,Value=CONNECT,QUERY},{Name=SERVER_AUDIT_INCL_USERS,Value=},{Name=SERVER_AUDIT_EXCL_USERS,Value=rdsadmin}]"

# Apply the option group to your RDS instance
aws rds modify-db-instance \
  --db-instance-identifier my-mysql-instance \
  --option-group-name mysql-audit-options \
  --apply-immediately

# Enable CloudWatch Logs export for MySQL audit logs
aws rds modify-db-instance \
  --db-instance-identifier my-mysql-instance \
  --cloudwatch-logs-export-configuration '{"EnableLogTypes":["audit","error","general","slowquery"]}'

# Create a new instance with CloudWatch logging enabled
aws rds create-db-instance \
  --db-instance-identifier my-mysql-instance \
  --db-instance-class db.m5.large \
  --engine mysql \
  --engine-version 8.0.35 \
  --master-username admin \
  --manage-master-user-password \
  --allocated-storage 100 \
  --option-group-name mysql-audit-options \
  --enable-cloudwatch-logs-exports '["audit","error","general","slowquery"]'

# Disable specific log exports (if needed)
aws rds modify-db-instance \
  --db-instance-identifier my-mysql-instance \
  --cloudwatch-logs-export-configuration '{"DisableLogTypes":["general","slowquery"]}'

-- Verify MariaDB Audit Plugin is installed and running
SHOW PLUGINS;
-- Look for: SERVER_AUDIT | ACTIVE | AUDIT | server_audit.so

-- Check current audit plugin settings
SHOW GLOBAL VARIABLES LIKE 'server_audit%';

-- View audit plugin status
SHOW GLOBAL STATUS LIKE 'server_audit%';

-- Common SERVER_AUDIT variables:
-- server_audit_logging        = ON
-- server_audit_events         = CONNECT,QUERY
-- server_audit_incl_users     = (users to include, empty = all)
-- server_audit_excl_users     = rdsadmin (exclude RDS admin user)
-- server_audit_query_log_limit = 1024 (max query length)

-- Note: These settings are configured via Option Groups in RDS
-- You cannot modify them directly via SQL in RDS

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "logs:DescribeLogGroups",
        "logs:DescribeLogStreams",
        "logs:GetLogEvents",
        "logs:FilterLogEvents"
      ],
      "Resource": [
        "arn:aws:logs:*:*:log-group:/aws/rds/instance/*/audit:*",
        "arn:aws:logs:*:*:log-group:/aws/rds/instance/*/error:*",
        "arn:aws:logs:*:*:log-group:/aws/rds/instance/*/general:*",
        "arn:aws:logs:*:*:log-group:/aws/rds/instance/*/slowquery:*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "rds:DescribeDBInstances",
        "rds:DescribeDBLogFiles",
        "rds:DownloadDBLogFilePortion"
      ],
      "Resource": "*"
    }
  ]
}

# DB Audit configuration for RDS MySQL via CloudWatch
databases:
  - name: production-rds-mysql
    type: mysql

    # RDS endpoint
    host: my-mysql-instance.xxxx.us-east-1.rds.amazonaws.com
    port: 3306
    database: your_database
    username: dbaudit_reader
    password: ${RDS_MYSQL_PASSWORD}

    # SSL is enabled by default for RDS
    ssl: true
    ssl_mode: VERIFY_IDENTITY

    options:
      # Use CloudWatch as the log source
      log_source: cloudwatch

      # CloudWatch configuration
      cloudwatch:
        region: us-east-1
        log_group: /aws/rds/instance/my-mysql-instance/audit

        # AWS credentials (use IAM role if running on EC2/ECS)
        # access_key_id: ${AWS_ACCESS_KEY_ID}
        # secret_access_key: ${AWS_SECRET_ACCESS_KEY}

        # Or use IAM role (recommended)
        use_iam_role: true

      # Polling interval for CloudWatch logs
      polling_interval: 30

      # Also query performance_schema directly for real-time data
      query_performance_schema: true

# View MySQL audit logs in CloudWatch Logs Insights
# Log group: /aws/rds/instance/<instance-id>/audit

# Query for failed login attempts
fields @timestamp, @message
| filter @message like /FAILED_CONNECT|Access denied/
| sort @timestamp desc
| limit 100

# Query for DDL operations (CREATE, DROP, ALTER)
fields @timestamp, @message
| filter @message like /,CREATE,|,DROP,|,ALTER,|,TRUNCATE,/
| sort @timestamp desc
| limit 100

# Query for specific user activity
fields @timestamp, @message
| filter @message like /,dbaudit_reader,/
| sort @timestamp desc
| limit 50

# Query for queries on sensitive tables
fields @timestamp, @message
| filter @message like /customers|credit_cards|passwords/
| sort @timestamp desc
| limit 100

# Parse audit log fields (CSV format)
fields @timestamp, @message
| parse @message "*,*,*,*,*,*,*,*,*" as timestamp, serverhost, username, host, connectionid, queryid, operation, database, object
| filter operation = "QUERY"
| sort @timestamp desc
| limit 50