Question

A security engineer needs to demonstrate to auditors exactly when an RDS instance transitioned from an encrypted (compliant) state to an unencrypted (non-compliant) state, and identify what configuration change triggered the transition. AWS Config is enabled in the account with the relevant managed rule active. Which approach provides the required historical evidence with the least custom development?

Accepted Answer

Use the AWS Config configuration timeline and compliance timeline for the RDS resource to review the sequence of configuration items and compliance status changes over time.

Answer

Enable VPC Flow Logs on the RDS subnet and query them in Athena to correlate traffic changes with the compliance transition.

Answer

Create a CloudWatch Logs metric filter on the RDS engine logs to detect encryption state changes and set an alarm.

Answer

Rely on GuardDuty RDS Protection findings to identify when the encryption setting was altered.