Question

A financial services company runs several Amazon Aurora PostgreSQL and Aurora MySQL clusters that contain sensitive customer data. The security team wants to detect suspicious login behavior against these databases, such as logins from unusual locations or brute-force attempts, without deploying agents or modifying the database engine. They already use GuardDuty for their EC2 and S3 workloads. What is the MOST appropriate way to meet this requirement?

Accepted Answer

Enable GuardDuty RDS Protection to analyze RDS login activity for supported Aurora clusters and generate findings for anomalous access.

Answer

Enable Aurora database activity streams and manually parse the Kinesis stream with a Lambda function to flag unusual logins.

Answer

Deploy Amazon Inspector to continuously scan the Aurora clusters for vulnerable database configurations and login anomalies.

Answer

Enable VPC Flow Logs on the database subnets and use Amazon Detective to visualize anomalous login patterns to the clusters.