Question 1

Is cloudwatch_log_group_kms_key_id enforced for SOC 2?

Accepted Answer

Yes, To help protect sensitive data at rest, ensure encryption is enabled for your AWS CloudWatch Log Group.

Question 2

Is cloudwatch_log_group_retention_in_days enforced for SOC 2?

Accepted Answer

Yes, Ensure a minimum duration of event log data is retained for your log groups to help with troubleshooting and forensics investigations.

Question 3

Is deletion_protection enforced for SOC 2?

Accepted Answer

Yes, This control checks whether RDS clusters have deletion protection enabled. This control is intended for RDS DB instances. However, it can also generate findings for Aurora DB instances, Neptune DB instances, and AWS DocumentDB clusters. If these findings are not useful,then you can suppress them.

Question 4

Is enabled_cloudwatch_logs_exports enforced for SOC 2?

Accepted Answer

Yes, This control checks whether an Amazon Aurora PostgreSQL DB cluster is configured to publish logs to Amazon CloudWatch Logs. The control fails if the Aurora PostgreSQL DB cluster isn't configured to publish PostgreSQL logs to CloudWatch Logs.

Question 5

Is kms_key_id enforced for SOC 2?

Accepted Answer

Yes, Ensure RDS DB cluster is encrypted using CMK. The rule is non-compliant if the RDS DB cluster is not encrypted using CMK.

Question 6

Is storage_encrypted enforced for SOC 2?

Accepted Answer

Yes, This control checks if an RDS DB cluster is encrypted at rest. The control fails if an RDS DB cluster isn't encrypted at rest.

AWS RDS Aurora Terraform module

Terraform Module Source