Aurora MySQL

Overview

Master Database User Security

MySQL Administrative Security

• Master user: Limit to necessary privileges, avoid SUPER privilege, existing priviliged are already limited in RDS, ensure you follow least privilege in your creation
• Use secure authentication methods = Avoid MySQL native, leverage IAM and Kerberos authentication where possible
• Enable SSL/TLS: requiresecuretransport = ON
• Enable comprehensive audit logging:

• Set connection limits:

• Configure password validation if using MySQL native (avoid if possible):

Security-Related Settings Restricted to Master User

1. User and Privilege Management

• CREATE USER
• DROP USER
• RENAME USER
• GRANT ALL PRIVILEGES
• REVOKE privileges
• SET PASSWORD for other users
• CREATE ROLE / DROP ROLE (Aurora MySQL 3.x)
• GRANT/REVOKE role memberships (Aurora MySQL 3.x)

• Controls database access and authentication
• Determines privilege levels for all users
• Manages password policies and authentication methods
• Unauthorized user creation could lead to data breaches
• Improper privilege grants violate least privilege principles
• Role mismanagement could enable privilege escalation

2. Database Creation and Management

• CREATE DATABASE
• DROP DATABASE
• ALTER DATABASE

• Database owners have extensive privileges within their databases
• Unauthorized database creation could consume resources
• Database deletion could result in data loss
• Database-level settings affect all objects and users

3. Replication Configuration

• REPLICATION CLIENT privilege
• REPLICATION SLAVE privilege
• Binary log access and configuration
• Read replica management

• Replication access allows reading all database data
• Binary logs contain all data modifications
• Could be used for unauthorized data exfiltration
• Improper replication configuration could expose sensitive data

4. Global System Variables

• SET GLOBAL for security-related variables
• Modification of authentication plugins
• SSL/TLS configuration changes
• Connection limits and timeouts

• Global variables affect all database connections
• Authentication changes could weaken security
• SSL/TLS misconfiguration could expose data in transit
• Connection limit changes could enable denial of service

5. Stored Procedure and Function Management

• CREATE ROUTINE
• ALTER ROUTINE
• DROP ROUTINE
• EXECUTE on privileged routines
• SETUSERID privilege (Aurora MySQL 3.x)

• Stored procedures can execute with elevated privileges
• Definer-rights procedures can bypass access controls
• Malicious procedures could compromise database security
• SETUSERID allows impersonation of other users

6. Event Scheduler Management

• CREATE EVENT
• ALTER EVENT
• DROP EVENT
• EVENT privilege

• Events execute automatically with creator's privileges
• Could be used to implement backdoors
• Malicious events could modify or exfiltrate data
• Event scheduler access requires careful auditing

7. Audit Logging Configuration

• Enabling/disabling server_audit plugin
• Configuring audit log events and filters
• Managing audit log retention

• Disabling audit logging could hide malicious activity
• Improper audit configuration may miss security events
• Audit log tampering could compromise investigations
• Audit settings are critical for compliance requirements

8. Process and Connection Management

• PROCESS privilege (view all connections)
• RELOAD privilege (flush privileges, logs)
• CONNECTION_ADMIN (Aurora MySQL 3.x)
• KILL connections

• PROCESS privilege reveals all active queries and data
• RELOAD can disrupt service or clear security settings
• CONNECTION_ADMIN allows bypassing connection limits
• KILL privilege could be used for denial of service

Best Practices for Master User Account Security

IAM Least Privilege Policies

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "rds:Describe*",
        "rds:List*",
        "rds:Get*"
      ],
      "Resource": "*"
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "rds:Describe*",
        "rds:List*",
        "rds:Get*",
        "rds:Update*",
        "rds:Put*",
        "rds:Create*"
      ],
      "Resource": "*",
      "Condition": {
        "Bool": {
          "aws:MultiFactorAuthPresent": "true"
        }
      }
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "rds:*",
      "Resource": "*",
      "Condition": {
        "Bool": {
          "aws:MultiFactorAuthPresent": "true"
        },
        "NumericLessThan": {
          "aws:MultiFactorAuthAge": "3600"
        }
      }
    }
  ]
}

Database Encryption

Implementation Examples

1. Create KMS Key for Aurora Encryption
   Create dedicated KMS key for encrypting Aurora MySQL cluster

# Create KMS key for Aurora encryption
aws kms create-key --description 'Aurora MySQL Encryption Key' --key-usage ENCRYPT_DECRYPT
# Create alias for the key
aws kms create-alias --alias-name alias/aurora-mysql-key --target-key-id arn:aws:kms:region:account:key/key-id

1. Create Encrypted Aurora MySQL Cluster
   Create Aurora cluster with encryption enabled and secure master user configuration

# Create encrypted Aurora MySQL cluster
aws rds create-db-cluster \
  --db-cluster-identifier my-aurora-cluster \
  --engine aurora-mysql \
  --master-username admin \
  --manage-master-user-password \
  --master-user-secret-kms-key-id alias/aurora-mysql-key \
  --storage-encrypted \
  --kms-key-id alias/aurora-mysql-key \
  --vpc-security-group-ids sg-xxxxxxxxx \
  --db-subnet-group-name private-subnet-group

1. Configure SSL/TLS and Audit Logging
   Enable SSL enforcement and comprehensive audit logging

# Create parameter group with SSL enforcement
aws rds create-db-cluster-parameter-group \
  --db-cluster-parameter-group-name aurora-mysql-secure \
  --db-parameter-group-family aurora-mysql8.0 \
  --description 'Secure Aurora MySQL parameters'

# Enable SSL enforcement and audit logging
aws rds modify-db-cluster-parameter-group \
  --db-cluster-parameter-group-name aurora-mysql-secure \
  --parameters ParameterName=require_secure_transport,ParameterValue=ON \
  --parameters ParameterName=server_audit_logging,ParameterValue=1 \
  --parameters ParameterName=server_audit_events,ParameterValue=CONNECT,QUERY,TABLE

Privileged Access Control

Implementation Examples

1. Implement Least Privilege Access
   Configure Amazon Aurora MySQL with minimal required permissions for administrative accounts

# Create least privilege IAM policy for Amazon Aurora MySQL administration
aws iam create-policy --policy-name ServiceAdminPolicy --policy-document file://admin-policy.json
# Attach policy to administrative role
aws iam attach-role-policy --role-name ServiceAdminRole --policy-arn arn:aws:iam::account:policy/ServiceAdminPolicy

1. Enable Multi-Factor Authentication
   Require MFA for all privileged operations and administrative access

# Create MFA-required policy condition
# Add MFA condition to administrative policies
# Verify MFA enforcement for privileged operations

1. Configure Privileged Activity Monitoring
   Enable comprehensive logging and monitoring of all privileged account activities

# Enable CloudTrail for API logging
aws cloudtrail create-trail --name ServicePrivilegedAccess --s3-bucket-name audit-logs
# Configure CloudWatch alarms for privileged operations
aws logs create-log-group --log-group-name /aws/service/privileged-access

Implementation

• Enable encryption at rest using customer-managed KMS keys
• Use AWS Secrets Manager for master user password management
• Enforce SSL/TLS connections for all database access
• Enable comprehensive audit logging and monitoring
• Deploy in private subnets with restrictive security groups
• Implement automated backup encryption
• Configure parameter groups with security-hardened settings

Cluster Management

Configure via AWS RDS APIs for Aurora MySQL cluster management

• Create separate roles for different access levels (read-only, operator, administrator)
• Always require MFA for privileged operations
• Use time-based conditions to limit session duration
• Implement resource-based restrictions where possible
• Regular review and rotation of access permissions