ASSOCIATED DRATA CONTROL
This test is part of the Databases Monitored and Alarmed control that ensures your company has implemented tools to monitor databases and notify appropriate personnel of any events or incidents, based on predetermined criteria.
WHAT TO DO IF A TEST FAILS
If Drata detects that database storage monitoring is not enabled or that alerts have not been properly set up the test will fail. With a failed test you will receive a list of databases that lack storage monitoring or administrative alerts.
To remediate a failed test, you will need to set up and configure monitoring for database storage to ensure they are monitored with alerts being sent to DB admins in an event or incident.
STEPS FOR PASSING
To ensure a validated state when testing for monitoring of the database free storage, please follow the steps listed in the table below. Once the provider steps have been completed, navigate back to Drata and execute the test.
Note for Datadog
If you are using the Datadog integration for this test, please refer to this help article for the metrics to be used.
Note for AWS DocDB Alarm Creation (Instance Metrics) and RDS Alarm Creation (Database Instance)
For clustered databases, the same alarm must be configured on each database instance for the test to pass. Although this article refers to alarms at the database level, the test validates alarms at the instance level.
AWS – Amazon DocumentDB (DocDB)
Database Creation
This section walks you through creating a DocumentDB cluster in AWS. The cluster is the resource Drata evaluates to confirm that database storage monitoring is enabled.
In AWS, navigate to the DocumentDB service.
Create a DocDB cluster.
Alarm Creation (Instance Metrics)
This section explains how to create a CloudWatch alarm that monitors available storage on each DocumentDB instance. The alarm triggers when storage drops below a defined threshold and is required for the test to pass.
Navigate to the CloudWatch service.
Select Create alarm.
Choose Select Metric.
Select DocDB.
Select Instance Metrics.
Search for
FreeLocalStorage.Select the checkbox for the database instance.
Set the condition to Static → Lower → than 10000 (10000 is an illustrative example; choose a value appropriate for your environment)
Select Next.
Choose or create an SNS topic.
Select Next.
Enter an alarm name.
Select Next, then Create alarm.
Subscription Confirmation
This section ensures the alarm can send notifications to the appropriate recipients. The test requires at least one confirmed SNS subscription so alerts are delivered when the alarm is triggered.
Option 1: Create a new subscription
Navigate to SNS and select Subscriptions.
Select Create subscription.
Use the SNS topic ARN created with the alarm.
Set Protocol to Email.
Enter an email address (typically a monitored team inbox).
Select Create subscription.
Confirm the subscription using the verification email sent to the inbox.
Option 2: Confirm an existing subscription
Navigate to SNS and select Topics.
Select the topic created with the alarm.
Under Subscriptions, select the subscription.
Choose Confirm subscription.
Verify the confirmation email.
Note (Cluster Metrics): You may also need to configure this alarm under Cluster Metrics for DocDB. Ensure the condition is set to Static → Lower than → 10000 (example value).
AWS – Amazon RDS
Supported Metrics by Engine
This section identifies which CloudWatch storage metric to use based on your RDS engine type. Selecting the correct metric ensures the alarm evaluates the appropriate storage behavior for your database.
For RDS Aurora PostgreSQL and Aurora MySQL (including Serverless v1), use
FreeLocalStorage.For Aurora Serverless v2, use
TempStorageThroughput.For RDS MySQL and RDS PostgreSQL, use
FreeStorageSpace.
Database Creation
This section covers creating an RDS database instance in AWS. The database instance is the resource Drata checks for storage monitoring and alert configuration.
In AWS, navigate to the RDS service.
Select Create database.
Choose Standard create.
Configure the database:
Engine options: Any
Template: Select as appropriate
Set a DB instance identifier
Credentials: Select Auto-generate password
Set a DB instance size
Availability & durability: Multi-AZ deployment – Do not create a standby instance
Select Create database.
Alarm Creation - Database Instance
This section describes how to create a CloudWatch alarm that monitors storage usage on an individual RDS database instance. This alarm is required for each instance being evaluated.
Navigate to CloudWatch.
Select Create CloudWatch Alarm.
Choose Select Metric.
Select RDS.
Select Per-Database Metrics.
Search for the appropriate metric based on your engine.
Search for "
FreeLocalStorage" on Aurora PostgreSQL and/or Aurora MySQL (including Serverless v1)Search for "
TempStorageThroughput" on Aurora Serverless v2Search for "
FreeStorageSpace" on RDS PostgreSQL
Select the checkbox for the database.
Set the condition to Static → Lower → than [Choose a value that makes sense for your setup such as 10000](10000 is an illustrative example)
Select Next.
Choose an SNS topic.
Select Next.
Enter an alarm name.
Select Next, then Create alarm.
Alarm Creation - Database Cluster
This section explains how to configure an additional CloudWatch alarm at the cluster level for clustered RDS engines, such as Aurora. This ensures storage monitoring is in place for cluster-level metrics.
Navigate to CloudWatch.
Select Create alarm.
Choose Select Metric.
Select RDS.
Select DBClusterIdentifier Metrics.
Search for your appropriate metric:
Search for "
FreeLocalStorage" on Aurora PostgreSQL and/or Aurora MySQL (including Serverless v1)Search for "
TempStorageThroughput" on Aurora Serverless v2Search for "
FreeStorageSpace" on RDS PostgreSQL
Select the checkbox for the database cluster.
Set the condition to Static → Lower → than [Choose a value that makes sense for your setup such as 10000](10000 is an illustrative example)
Select Next.
Choose an SNS topic.
Select Next.
Enter an alarm name.
Select Next, then Create alarm.
Subscription Confirmation
This section confirms that the SNS topic associated with the alarm has an active, confirmed subscription. Without a confirmed subscription, alerts cannot be delivered and the test will fail.
Go to SNS and select Subscriptions
Click "Create subscription" and reference the newly created topic for the Topic ARN
For Protocol select Email
For Endpoint enter an email address, generally a monitored team inbox
Click "Create subscription" and verify the email that was sent to your provided inbox
Alternatively:
Go to SNS and select Topics
Click the topic name created with the alarm
Under the Subscriptions banner, click the radio button for the topic's subscription
Click "Confirm subscription" and verify the email that was sent to your provided inbox
Azure – MariaDB, MySQL, PostgreSQL
Create a MariaDB, MySQL, or PostgreSQL server.
Create an alert rule for Storage percent.
Add an action to the alert rule.
Ensure Target resource type is set.
Ensure Target resource region is set.
Save the alert rule.
Azure – SQL Database
Create an Azure SQL Server.
Create an SQL Database on the server.
Create an alert rule on the database for:
Data Space Used, or
Data Space Used Percent
Add an action to the alert rule.
Ensure Target resource type is set.
Ensure Target resource region is set.
Save the alert rule.
Azure – SQL Managed Instance
Create a SQL Managed Instance.
Create at least one managed database under the instance.
Create an alert rule on the SQL Managed Instance (not the individual or lower level database) for Storage space used.
Add an action to the alert rule.
Ensure Target resource type is set.
Ensure Target resource region is set.
Save the alert rule.
GCP – Cloud SQL
Database Creation
In GCP, navigate to the Cloud SQL service.
Create an instance.
Select a database engine.
Enter an Instance ID.
Set a root user password.
Select a Region and Zone.
Under Customize your instance, select Show Configuration Options.
Open "Machine type"
Select a machine size
Open "Backups"
Make sure "Automate backups" is checked
Set other settings as desired
Click on Create button
Alert Creation
Navigate to GCP Monitoring.
Select Alerting from the left menu.
Select Create policy.
On the "Create alerting policy" form click on Add Condition.
In Find resource type and metric, search for SQL.
Select Disk utilization.
Set:
Resource type: Cloud SQL Database
Metric: Disk utilization
By default the GCP Alert UI may only show "Active" metrics, and you may need to turn that toggle off to see the required option
In the configuration add a value for Threshold: Choose a value that makes sense for your setup such as 70. 70 is an illustrative example
Select Add.
Under Alert details, assign a notification channel (any except mobile cloud console).
Select Next.
Enter an alert name.
Select Save.