Question

A financial services company runs a production Amazon Aurora MySQL cluster that stores customer account data. The security team recently enabled GuardDuty RDS Protection across the organization. GuardDuty generates a finding of type 'CredentialAccess:RDS/AnomalousBehavior.SuccessfulLogin' indicating a successful login to the Aurora cluster from an unusual location using a rarely used database user. The security team needs to confirm the scope of the activity and quickly contain the potentially compromised database credential while minimizing disruption to legitimate applications. Which combination of actions BEST addresses this incident?

Accepted Answer

Rotate or disable the specific database user's credential, tighten the cluster security group and database user privileges, and review the RDS and CloudTrail activity to determine what the login accessed.

Answer

Immediately delete the Aurora cluster and restore from the most recent automated snapshot to eliminate the compromised credential.

Answer

Disable GuardDuty RDS Protection to stop the recurring findings, then open a support case with AWS to investigate the login.

Answer

Enable IAM database authentication for the cluster and rely on it to automatically revoke the anomalous session already in progress.