Question 1

Is cloudwatch_log_group_retention_in_days enforced for FFIEC Cybersecurity Assessment Tool?

Accepted Answer

Yes, Ensure a minimum duration of event log data is retained for your log groups to help with troubleshooting and forensics investigations.

Question 2

Is cluster_monitoring_interval enforced for FFIEC Cybersecurity Assessment Tool?

Accepted Answer

Yes, Enable AWS Relational Database Service (AWS RDS) to help monitor AWS RDS availability. This provides detailed visibility into the health of your AWS RDS database instances.

Question 3

Is deletion_protection enforced for FFIEC Cybersecurity Assessment Tool?

Accepted Answer

Yes, This control checks whether RDS clusters have deletion protection enabled. This control is intended for RDS DB instances. However, it can also generate findings for Aurora DB instances, Neptune DB instances, and AWS DocumentDB clusters. If these findings are not useful,then you can suppress them.

Question 4

Is instances enforced for FFIEC Cybersecurity Assessment Tool?

Accepted Answer

Yes, This control checks if automatic minor version upgrade is enabled for an Amazon RDS database cluster. The control fails if automatic minor version upgrade isn't enabled for an RDS cluster.

AWS RDS Aurora Terraform module

Terraform Module Source