AnalysisType: rule
Filename: aws_rds_instance_rebooted.py
RuleID: "AWS.RDS.InstanceRebooted"
DisplayName: "AWS RDS Instance or Cluster Rebooted"
Enabled: true
LogTypes:
- AWS.CloudTrail
Tags:
- AWS
- Impact
- Availability
- Endpoint Denial of Service
- RDS
Severity: Medium
Description: >
Detects when RDS instances, clusters, or shard groups are rebooted. Unexpected reboots
cause service disruption and may indicate DoS attempts, unauthorized testing, or
operational issues requiring investigation.
Runbook: |
1. Find all database reboot events by the user ARN in the past 24 hours to identify bulk reboot patterns
2. Check if this user has rebooted databases in the past 90 days to determine if this is normal behavior
3. Look for database modification events from this user in the 30 minutes before the reboot
Reference: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_RebootInstance.html
Reports:
MITRE ATT&CK:
- TA0040:T1499 # Endpoint Denial of Service
DedupPeriodMinutes: 60
SummaryAttributes:
- eventName
- userIdentity:principalId
- requestParameters:dBInstanceIdentifier
- requestParameters:dBClusterIdentifier
- p_any_aws_account_ids
Threshold: 1
Tests:
- Name: DB Instance Rebooted
ExpectedResult: true
Log:
eventVersion: "1.08"
userIdentity:
type: AssumedRole
principalId: "AIDAI23HXS3EXAMPLE:admin"
arn: "arn:aws:sts::123456789012:assumed-role/DBARole/admin"
accountId: "123456789012"
accessKeyId: "ASIAIOSFODNN7EXAMPLE"
eventTime: "2024-01-18T02:00:00Z"
eventSource: rds.amazonaws.com
eventName: RebootDBInstance
awsRegion: us-east-1
sourceIPAddress: "10.0.1.100"
userAgent: "console.amazonaws.com"
requestParameters:
dBInstanceIdentifier: "production-mysql"
forceFailover: false
responseElements:
dBInstanceIdentifier: "production-mysql"
dBInstanceStatus: "rebooting"
requestID: "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
eventID: "f1e2d3c4-b5a6-7890-1234-567890abcdef"
readOnly: false
eventType: AwsApiCall
managementEvent: true
recipientAccountId: "123456789012"
eventCategory: Management
- Name: DB Cluster Rebooted with Failover
ExpectedResult: true
Log:
eventVersion: "1.08"
userIdentity:
type: IAMUser
principalId: "AIDAI23HXS3EXAMPLE"
arn: "arn:aws:iam::123456789012:user/operator"
accountId: "123456789012"
accessKeyId: "AKIAIOSFODNN7EXAMPLE"
userName: operator
eventTime: "2024-01-18T02:00:00Z"
eventSource: rds.amazonaws.com
eventName: RebootDBCluster
awsRegion: us-west-2
sourceIPAddress: "203.0.113.100"
userAgent: "aws-cli/2.13.0"
requestParameters:
dBClusterIdentifier: "aurora-cluster-prod"
forceFailover: true
responseElements:
dBClusterIdentifier: "aurora-cluster-prod"
status: "rebooting"
requestID: "b2c3d4e5-f6a7-8901-bcde-f1234567890a"
eventID: "g2f3e4d5-c6b7-8901-2345-678901bcdefg"
readOnly: false
eventType: AwsApiCall
managementEvent: true
recipientAccountId: "123456789012"
eventCategory: Management
- Name: Reboot Failed
ExpectedResult: false
Log:
eventVersion: "1.08"
userIdentity:
type: IAMUser
principalId: "AIDAI23HXS3EXAMPLE"
arn: "arn:aws:iam::123456789012:user/developer"
accountId: "123456789012"
accessKeyId: "AKIAIOSFODNN7EXAMPLE"
userName: developer
eventTime: "2024-01-18T02:00:00Z"
eventSource: rds.amazonaws.com
eventName: RebootDBInstance
awsRegion: us-east-1
sourceIPAddress: "10.0.2.100"
userAgent: "aws-cli/2.13.0"
requestParameters:
dBInstanceIdentifier: "production-db"
errorCode: InvalidDBInstanceState
errorMessage: "Cannot reboot DB instance in current state"
requestID: "c3d4e5f6-a7b8-9012-cdef-1234567890ab"
eventID: "h3g4f5e6-d7c8-9012-3456-789012cdefgh"
readOnly: false
eventType: AwsApiCall
managementEvent: true
recipientAccountId: "123456789012"
eventCategory: Management
- Name: Different RDS Event
ExpectedResult: false
Log:
eventVersion: "1.08"
userIdentity:
type: AssumedRole
principalId: "AIDAI23HXS3EXAMPLE:user"
arn: "arn:aws:sts::123456789012:assumed-role/Admin/user"
accountId: "123456789012"
eventTime: "2024-01-18T02:00:00Z"
eventSource: rds.amazonaws.com
eventName: StartDBInstance
awsRegion: us-east-1
sourceIPAddress: "10.0.1.100"
requestParameters:
dBInstanceIdentifier: "dev-database"
requestID: "d4e5f6a7-b8c9-0123-def0-1234567890bc"
eventID: "i4h5g6f7-e8d9-0123-4567-890123defghi"
readOnly: false
eventType: AwsApiCall
managementEvent: true
recipientAccountId: "123456789012"
eventCategory: Management
# ------ paired body: aws_rds_instance_rebooted.py ------
from panther_aws_helpers import aws_rule_context
def rule(event):
if event.get("eventSource") != "rds.amazonaws.com":
return False
reboot_events = ["RebootDBInstance", "RebootDBCluster", "RebootDBShardGroup"]
if event.get("eventName") not in reboot_events:
return False
return event.deep_get("errorCode") is None
def title(event):
event_name = event.get("eventName", "Unknown")
db_identifier = (
event.deep_get("requestParameters", "dBInstanceIdentifier")
or event.deep_get("requestParameters", "dBClusterIdentifier")
or event.deep_get("requestParameters", "dBShardGroupIdentifier", default="<UNKNOWN>")
)
user = event.deep_get("userIdentity", "userName") or event.deep_get(
"userIdentity", "principalId", default="<UNKNOWN_USER>"
)
resource_type = (
"Instance"
if event_name == "RebootDBInstance"
else "Cluster" if event_name == "RebootDBCluster" else "Shard Group"
)
return f"RDS {resource_type} Rebooted: [{db_identifier}] by [{user}]"
def alert_context(event):
context = aws_rule_context(event)
context["resource_identifier"] = (
event.deep_get("requestParameters", "dBInstanceIdentifier")
or event.deep_get("requestParameters", "dBClusterIdentifier")
or event.deep_get("requestParameters", "dBShardGroupIdentifier", default="N/A")
)
context["force_failover"] = event.deep_get("requestParameters", "forceFailover", default="N/A")
return context