Log in to your AWS account.

To create a role for audits, run the following SQL query with a user with administrative credentials for your data source:

CREATE ROLE rds_pgaudit;

Create a new parameter group for your database and specify the following values:

Edit the parameter group that you created in the previous step and set the following values:

Associate the parameter group that you created with your database. Modify the configuration for the database instance and make the following changes:

When prompted, choose the option to immediately apply the changes you made in the previous step.

Restart the database instance.

From the Amazon RDS console, View the logs for your database instance from the RDS console.

From the CloudWatch console, complete the following steps:

From the AWS console, create a new Amazon SQS queue with the default settings. Use the following format when specifying a value for the Name field:

privacera-postgres-<RDS_CLUSTER_NAME>-audits

where:

After the queue is created save the URL of the queue for use later.

From the IAM console, create a new IAM policy and input the following JSON:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "logs:CreateLogGroup",
            "Resource": "arn:aws:logs:<REGION>:<ACCOUNT_ID>:*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ],
            "Resource": [
                "arn:aws:logs:<REGION>:<ACCOUNT_ID>:log-group:/aws/lambda/<LAMBDA_FUNCTION_NAME>:*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": "sqs:SendMessage",
            "Resource": "arn:aws:sqs:<REGION>:<ACCOUNT_ID>:<SQS_QUEUE_NAME>"
        }
    ]
}

where:

Specify a name for the IAM policy, such as privacera-postgres-audits-lambda-execution-policy, and then create the policy.

From the IAM console, create a new IAM role and choose for the Use case the Lambda option.

Search for the IAM policy that you just created with a name that might be similar to privacera-postgres-audits-lambda-execution-policy and select it.

Specify a Role name for the IAM policy, such as privacera-postgres-audits-lambda-execution-role, and then create the role.

From the AWS Lambda console, create a new function and specify the following fields:

Add a trigger to the function you created in the previous step and select CloudWatch Logs from the list, and then specify the following values:

In the Lambda source code editor, provide the following JavaScript code in the index.js file, which is open by default in the editor:

var zlib = require('zlib');

// CloudWatch logs encoding
var encoding = process.env.ENCODING || 'utf-8';  // default is utf-8
var awsRegion = process.env.REGION || 'us-east-1';
var sqsQueueURL = process.env.SQS_QUEUE_URL;
var ignoreDatabase = process.env.IGNORE_DATABASE;
var ignoreUsers = process.env.IGNORE_USERS;

var ignoreDatabaseArray = ignoreDatabase.split(',');
var ignoreUsersArray = ignoreUsers.split(',');

// Import the AWS SDK
const AWS = require('aws-sdk');

// Configure the region
AWS.config.update({region: awsRegion});

exports.handler = function (event, context, callback) {

    var zippedInput = Buffer.from(event.awslogs.data, 'base64');

        zlib.gunzip(zippedInput, function (e, buffer) {
        if (e) {
            callback(e);
        }

        var awslogsData = JSON.parse(buffer.toString(encoding));

        // Create an SQS service object
        const sqs = new AWS.SQS({apiVersion: '2012-11-05'});

        console.log(awslogsData);
        if (awslogsData.messageType === 'DATA_MESSAGE') {

            // Chunk log events before posting
            awslogsData.logEvents.forEach(function (log) {

                //// Remove any trailing \n
                console.log(log.message)

                // Checking if message falls under ignore users/database
                var sendToSQS = true;

                if(sendToSQS) {

                    for(var i = 0; i < ignoreDatabaseArray.length; i++) {
                       if(log.message.toLowerCase().indexOf("@" + ignoreDatabaseArray[i]) !== -1) {
                            sendToSQS = false;
                            break;
                       }
                    }
                }

                if(sendToSQS) {

                    for(var i = 0; i < ignoreUsersArray.length; i++) {
                       if(log.message.toLowerCase().indexOf(ignoreUsersArray[i] + "@") !== -1) {
                            sendToSQS = false;
                            break;
                       }
                    }
                }

                if(sendToSQS) {
                
                    let sqsOrderData = {
                        MessageBody: JSON.stringify(log),
                        MessageDeduplicationId: log.id,
                        MessageGroupId: "Audits",
                        QueueUrl: sqsQueueURL
                    };

                    // Send the order data to the SQS queue
                    let sendSqsMessage = sqs.sendMessage(sqsOrderData).promise();

                    sendSqsMessage.then((data) => {
                        console.log("Sent to SQS");
                    }).catch((err) => {
                        console.log("Error in Sending to SQS = " + err);
                    });

                }
            });
        }
    });
};

For the Lambda function, edit the environment variables and create the following environment variables:

From the IAM console, create a new IAM policy and input the following JSON:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "sqs:DeleteMessage",
                "sqs:GetQueueUrl",
                "sqs:ListDeadLetterSourceQueues",
                "sqs:ReceiveMessage",
                "sqs:GetQueueAttributes"
            ],
            "Resource": "<SQS_QUEUE_ARN>"
        },
        {
            "Effect": "Allow",
            "Action": "sqs:ListQueues",
            "Resource": "*"
        }
    ]
}

where:

Specify a name for the IAM policy, such as postgres-audits-sqs-read-policy, and create the policy.

Attach the IAM policy to the AWS EC2 instance where you installed Privacera.