Ensure Sensitive OSS Query Interfaces Are Audited

FaibleNiveau 2Revue manuelletdsql

Description

OSS audits write-type operations by default, but query interfaces can disclose account, topology, KMS, or other sensitive management information. Organizations must either audit all query interfaces or maintain an approved set of sensitive query interfaces that are explicitly audited.

Méthode de vérification

Méthode d'audit: Revue manuelle

Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.

Confirm one of the following through the supported OSS configuration: 1. query_interfaces_logged_in_audit = 1; or 2. query_interfaces_logged_in_audit = 0 and query_interfaces_audit_set contains the complete approved sensitive- interface list. At minimum, evaluate interfaces exposing users, cluster topology, KMS configuration, OSS users, and security settings. Invoke a non-destructive approved interface and confirm its record reaches both the OSS audit store and centralized destination.

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Enable full query auditing or configure the reviewed sensitive-interface set through the supported OSS configuration mechanism. Representative interfaces include TDSQL.ListUser, TDSQL.GetSetInfo, TDSQL.GetKmsConfig, TDSQL.GetClusterName, and TDSQL.GetOssUsers; derive the authoritative list from the deployed version and data-classification requirements.

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: tdsqlloggingauditoss
Référence: CIS Tencent TDSQL 10.3.22 Benchmark v1.0.0 - 6.10 Ensure Sensitive OSS Query Interfaces Are Audited