Authentication Guide

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "dsql:DbConnect",
      "Resource": "arn:aws:dsql:us-east-1:123456789012:cluster/<cluster-id>",
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/Environment": "development"
        }
      }
    }
  ]
}

# Good - Use Parameter Store
export CLUSTER_ENDPOINT=$(aws ssm get-parameter \
  --name /myapp/dsql/endpoint \
  --query 'Parameter.Value' \
  --output text)

# Bad - Hardcoded in code
const endpoint = "abc123.dsql.us-east-1.on.aws" // BAD: Use Parameter Store instead

sslmode: verify-full
sslnegotiation: direct      # PostgreSQL 17+ drivers (better performance)
port: 5432
database: postgres           # single database per cluster

# Ensure S3 bucket has SSE-KMS encryption
aws s3api put-bucket-encryption \
  --bucket my-cloudtrail-bucket \
  --server-side-encryption-configuration '{
    "Rules": [{"ApplyServerSideEncryptionByDefault": {"SSEAlgorithm": "aws:kms", "KMSMasterKeyID": "arn:aws:kms:us-east-1:123456789012:key/<key-id>"}}]
  }'

# Apply a bucket policy scoped to THIS account's CloudTrail trail.
# Replace 123456789012 with your account ID and dsql-audit-trail with your trail name.
cat > /tmp/cloudtrail-bucket-policy.json <<'POLICY'
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AWSCloudTrailAclCheck",
      "Effect": "Allow",
      "Principal": {"Service": "cloudtrail.amazonaws.com"},
      "Action": "s3:GetBucketAcl",
      "Resource": "arn:aws:s3:::my-cloudtrail-bucket",
      "Condition": {
        "StringEquals": {
          "aws:SourceArn": "arn:aws:cloudtrail:us-east-1:123456789012:trail/dsql-audit-trail",
          "aws:SourceAccount": "123456789012"
        }
      }
    },
    {
      "Sid": "AWSCloudTrailWrite",
      "Effect": "Allow",
      "Principal": {"Service": "cloudtrail.amazonaws.com"},
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::my-cloudtrail-bucket/AWSLogs/123456789012/*",
      "Condition": {
        "StringEquals": {
          "s3:x-amz-acl": "bucket-owner-full-control",
          "aws:SourceArn": "arn:aws:cloudtrail:us-east-1:123456789012:trail/dsql-audit-trail",
          "aws:SourceAccount": "123456789012"
        }
      }
    }
  ]
}
POLICY
aws s3api put-bucket-policy --bucket my-cloudtrail-bucket --policy file:///tmp/cloudtrail-bucket-policy.json

# Create a trail that logs DSQL management events.
# --enable-log-file-validation lets you detect tampered/deleted log files.
# --cloud-watch-logs-* parameters are REQUIRED for the metric filter and
# alarm below to receive events; without them CloudTrail only delivers to S3.
aws cloudtrail create-trail \
  --name dsql-audit-trail \
  --s3-bucket-name my-cloudtrail-bucket \
  --is-multi-region-trail \
  --kms-key-id arn:aws:kms:us-east-1:123456789012:key/<key-id> \
  --enable-log-file-validation \
  --cloud-watch-logs-log-group-arn arn:aws:logs:us-east-1:123456789012:log-group:CloudTrail/DefaultLogGroup:* \
  --cloud-watch-logs-role-arn arn:aws:iam::123456789012:role/CloudTrail_CloudWatchLogs_Role

aws cloudtrail start-logging --name dsql-audit-trail

# Encrypt the CloudWatch Log Group (DSQL auth events may contain sensitive metadata)
aws logs associate-kms-key \
  --log-group-name CloudTrail/DefaultLogGroup \
  --kms-key-id arn:aws:kms:us-east-1:123456789012:key/<key-id>

# Create a metric filter for failed authentication attempts
aws logs put-metric-filter \
  --log-group-name CloudTrail/DefaultLogGroup \
  --filter-name DSQLFailedAuth \
  --filter-pattern '{ ($.eventSource = "dsql.amazonaws.com") && ($.errorCode = "AccessDenied*") }' \
  --metric-transformations metricName=DSQLFailedAuth,metricNamespace=DSQL/Security,metricValue=1

# Create an alarm on failed auth attempts