An ecommerce company runs applications in AWS accounts that are part of an organization in AWS Organizations. The applications run on Amazon Aurora PostgreSQL databases across all the accounts. The…

Question

Options

• AAttach service control policies (SCPs) to the root of the organization to identify the failed login
• BEnable the Amazon RDS Protection feature in Amazon GuardDuty for the member accounts of
• CPublish the Aurora general logs to a log group in Amazon CloudWatch Logs. Export the log data
• DPublish all the Aurora PostgreSQL database events in AWS CloudTrail to a central Amazon S3

• A
  8% (5)
• B
  71% (46)
• C
  18% (12)
• D
  3% (2)

Explanation

Amazon GuardDuty includes RDS Protection that "monitors and profiles access to your Amazon Aurora and Amazon RDS databases" to detect threats such as suspicious login attempts, brute- force activity, and anomalous authentication patterns. GuardDuty can be enabled organization- wide in AWS Organizations with a delegated administrator to centralize findings for all member accounts, minimizing operational overhead. Findings include context like source IP, user, and DB instance, and integrate with Amazon EventBridge for alerting and automated response. SCPs (A) enforce or deny API permissions but do not provide detection/analytics. Exporting general logs (C) requires building and maintaining custom parsing/analytics pipelines. CloudTrail (D) records AWS control-plane API calls and does not log database-level login attempts. Therefore, enabling GuardDuty RDS Protection across the org provides the most operationally efficient, managed detection of abnormal failed and incomplete login attempts.

No community discussion yet for this question.