JA EN
shiichan

Amazon RDS for SQL Server Can Now Stream Audit Logs to CloudWatch in Real Time!

AWS What's New ★★ View Markdown
#aws#security#infrastructure

Hi, it's Shiichan! Today I've got a quiet but useful update for anyone running RDS.

AWS What's New aws.amazon.com

What was announced?

According to AWS What's New, Amazon RDS for SQL Server can now publish SQL Server Audit logs to Amazon CloudWatch. SQL Server Audit is a native SQL Server feature that tracks and logs events happening on the database engine, and on RDS you can create audits and audit specifications the same way you would on-premises. With this update, the destination for those audit logs now extends beyond S3 to CloudWatch as well.

The story so far

Until now, RDS for SQL Server audit logs could only be published to S3. If you wanted to analyze that data, you had to ingest it into another tool or review it after the fact in batches, which wasn't a great fit for keeping an eye on what's happening right now.

What changes

  • You can now choose S3, CloudWatch, or both as the destination for your audit logs
  • If both are enabled, the publication is only marked "completed" once the log files have been uploaded to both S3 and CloudWatch
  • With logs flowing into CloudWatch, you can now analyze audit log data in real time
  • If you enable retention, RDS also keeps your audit logs on the DB instance for the configured period

This is a quietly useful update if you want to fold audit logs into CloudWatch alarms or other monitoring you already have set up for security or compliance purposes.

Dive Deep

For details on SQL Server Audit itself, check "SQL Server Audit (database engine)" in the SQL Server documentation. For setup steps on RDS, see the Amazon RDS for SQL Server User Guide. This is available in all AWS Commercial Regions and AWS GovCloud (US) Regions where Amazon RDS for SQL Server is available.

Wrap-up

  • Amazon RDS for SQL Server audit logs can now be published to CloudWatch
  • You can choose S3, CloudWatch, or both — with both enabled, "completed" means uploaded to both
  • CloudWatch lets you analyze audit log data in real time
  • Enabling retention also keeps audit logs on the DB instance itself
  • Available in all AWS Commercial Regions and supported AWS GovCloud (US) Regions

A solid pick for DBAs and security folks who want to fold SQL Server audit data into their CloudWatch monitoring setup!

Related posts