McAfee Database Security 4.6.3
Configuring AWS RDS Monitoring
Configuring AWS RDS monitoring
Overview
COPYRIGHT
© 2017 McAfee Corporation
TRADEMARK ATTRIBUTIONS
McAfee and the McAfee logo, McAfee Active Protection, McAfee DeepSAFE, ePolicy Orchestrator, McAfee ePO, McAfee EMM, Foundstone, McAfee
LiveSafe, McAfee QuickClean, Safe Eyes, McAfee SECURE, SecureOS, McAfee Shredder, SiteAdvisor, McAfee Stinger, TrustedSource, VirusScan are
trademarks of McAfee LLC or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others.
LICENSE INFORMATION
License Agreement
NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL
TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES
AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS
PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE).
IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE
OR THE PLACE OF PURCHASE FOR A FULL REFUND.
Configuring AWS RDS monitoring
Overview
Configuring AWS RDS monitoring
You can use AWS (Amazon Web Services) MariaDB plug-in’s auditing feature to monitor AWS RDS
(Relational Database Service) MySQL and MariaDB instances running on AWS.
Note
Only MariaDB and MySQL databases are currently supported.
AWS RDS MySQL and MariaDB database auto-detection and AWS RDS monitoring support were
introduced in McAfee® Database Security, version 4.6.3.
Overview
You can monitor AWS RDS MySQL and MariaDB instances using a remote sensor installed on an EC2
Linux RHEL 6.7 (and up) s or a remote sensor on any other Linux RHEL6.7 (and up) computer that can
be reached using TCP communication and has an access to RDS instances. The only difference
between those two configurations is performance. A sensor outside the AWS network is less effective
than a sensor in the AWS network.
Note
AWS RDS monitoring is supported only by a Linux RHEL 6.7 (and up) 64-bit sensor.
The AWS MariaDB plug-in writes the database activity to local log files, which the sensor retrieves
using AWS API.
Read plugin audit log
files
MariaDB
AWS SDK
using
HTTPS
AWS RDS Service
DAM sensor
(AWS
EC2
Linux
RHEL
6.7)
Amazon RDS uses Option Groups to enable and configure additional features for database
management. An Option Group associated with a monitored AWS RDS instance must be configured to
enable MariaDB plug-in audit files to be monitored by a sensor.
The McAfee DAM sensor uses AWS account credentials to access the RDS service and retrieve log files
using AWS SDK. The credentials must be set on McAfee database security server using advanced
parameters.
A single sensor can monitor several RDS DB instances, but cannot monitor both local and remote
instances. DAL connection is not active.
Configuring AWS RDS monitoring
Step 1: Create AWS account credentials
To fully utilize the sensor’s capabilities, we recommend you install the sensor on an EC2 system on the
same network as the RDS.
Tasks
Step
Step
Step
Step
1:
2:
3:
4:
Create AWS account credentials.
Create and configure an option group
Associate option group with RDS option
Enable AWS RDS monitoringStep 4: Enable AWS RDS monitoring
Step 1: Create AWS account credentials
You need to create AWS credentials and set DAM sensor’s advanced parameters before you can
monitor AWS RDS instances.
Task
1
Connect to AWS management console https://<Your_Account>.aws.amazon.com/console with
your AWS account.
2
At the top of the console, select your user name, then select My Security Credentials.
3
From the left menu click, select Encryption Keys, then click Create Key.
4
Enter a name for the key, then assign your user Key Administrative Permissions and Key Usage Permissions (no
tags needed).
5
Select Dashboard | Rotate your access keys | Manage user account keys
6
Select |Security credentials | Create access key.
7
Download the file, then open it to view the Access key ID and Secret access key.
Note
The DAM Sensor monitors one AWS account.
Step 2: Create and configure an option group
Next, you need to create an Option Group and enable the MariaDB plug-in.
Note
This task specifies the steps required to enable the audit file option.
A more comprehensive explanation can be found at Amazon Web Services website.
Task
1
Connect to the AWS management console with your AWS account.
2
Select RDS | Option Groups | Create Group.
3
Enter a group name and description.
4
From the Engine drop-down list, select the database instance type (mariadb or mysql).
Configuring AWS RDS monitoring
Step 3: Associate option group with RDS option
5
In the Major Engine Version field, enter the engine version and click Create.
6
From the Option Groups page, select the option group, then click Add Option.
7
Select MARIADB_AUDIT_PLUG-IN, then set the SERVER_AUDIT_FILE_ROTATIONS and
SERVER_AUDIT_FILE_ROTATE_SIZE values.
You can set SERVER_AUDIT_FILE_PATH or use the default setting (audit).
Note
8
For best performance, we recommend the
SERVER_AUDIT_FILE_ROTATE_SIZE be set to 500 MB or higher.
Verify that the option settings were added to the properties for the selected Option Group.
Step 3: Associate option group with RDS option
To monitor an AWS RDS instance, log messages must be written to local audit log files. This is enabled
by associating the AWS RDS instance with an option group, with the MariaDB plug-in enabled.
Task
1
From the RDS Dashboard, select Instances.
2
Select the DB instance, then click Instance actions | Modify.
3
From the Option Group drop-down list, select demo to enable the MariaDB plug-in’s audit option.
Note
Important
You should use the same Option Group settings for all monitored AWS RDS DB
instances. All databases should enable the MariaDB plug-in, use the same log size,
rotations, and log file path.
Verify that the audit plug-in log files are generated.
Step 4: Enable AWS RDS monitoring
Before you can monitor AWS RDS databases, you need to enable AWS monitoring in the McAfee
Database Security console.
Task
1
On the Sensor properties page, click Advanced.
2
In the text box, add the following entries on separate lines:
aws.enable=1
[Enables AWS monitoring]
aws_access_key=<Access key ID>
aws_secret_key=<Secret access key>
aws_session_token=
aws_file_path=audit
[AWS access key]
[AWS secret key]
[AWS session token (optional)]
[Logs file path prefix, default=’audit’]
Configuring AWS RDS monitoring
Performance and Limitations
aws_file_size=500
aws_file_rotation=10
[Log file size (MB), default=500]
[Log file rotations, default=10]
To determine the aws_file_path, aws_file_size and aws_file_rotation settings, go to Services | RDS |
Instances. Expand your DMBS, click the Details tab, then click Option group.
The setting for each parameter is displayed in the Settings column.
3
Restart the sensor.
The sensor should detect the AWS RDS database.
4
Start monitoring the detected AWS RDS database. (An alternative connection is not required, you
can deselect the corresponding option).
5
Add rules for the database.
Note
rdsdbdata/log/ is a prefix for any logs folder, so set the log folder name only in the
advanced parameter, for example, aws_file_path=audit.
Performance and Limitations
Advanced parameter settings for the McAfee DAM sensor must be aligned with the AWS account
credentials and Option Group settings. In the event of a change, you must update the sensor settings
and restart the sensor.
">
