An ApsaraDB RDS for MySQL instance is compliant if the SQL explorer and audit feature is enabled and SQL audit logs are retained for at least the specified number of days.
Scenarios
Retaining SQL audit logs for a sufficient number of days supports auditing, performance diagnostics, and compliance with legal and regulatory log retention requirements.
Risk level
Default risk level: medium.
You can change the risk level based on your business requirements when you apply this rule.
Compliance evaluation logic
- If the SQL explorer and audit feature is enabled for an ApsaraDB RDS for MySQL instance and SQL audit logs are retained for at least the specified number of days, the evaluation result is Compliant.
- If the SQL explorer and audit feature is disabled for an ApsaraDB RDS for MySQL instance and SQL audit logs are retained for fewer than the specified number of days, the evaluation result is Incompliant. For more information, see Incompliance remediation.
Rule details
| Item | Description |
| Rule name | rds-instance-sql-collector-retention |
| Rule identifier | rds-instance-sql-collector-retention |
| Tag | RDS, SQLAuditing, Retenion, and AuditBaseline |
| Automatic remediation | Supported |
| Trigger type | Configuration change |
| Supported resource type | ApsaraDB RDS instance |
| Input parameter | days. Default value: 180. Unit: days.Note Separate multiple values with commas (,). |
Incompliance remediation
Enable the SQL explorer and audit feature for an ApsaraDB RDS for MySQL instance and set an appropriate retention period for SQL audit logs. For more information, see Use the SQL Explorer feature on an ApsaraDB RDS for MySQL instance.