MySQL RDS instance was deleted, and I don't know why

0

A MySQL RDS instance was deleted from our account a couple of days ago. We can tell when the instance was deleted from the logs of a web app that uses the database, as well as from the timestamp on a snapshot of the instance that was created before it was deleted.

The only events in the CloudTrail log at the time were KMS RetireGrant events. There was no user name associated with the events. The RetireGrants appear to have revoked grants that were created in 2012.

I've included the JSON of one of the grants that was retired, below. There were 4, altogether.

We didn't lose any data, because the system created a snapshot before it deleted the instance. But I want to understand what happened, and what I can do to make sure it doesn't happen again.

Is it possible the instance was deleted because it was running an old version of MySQL, and we missed update notices?

{
    "Version": "2012-10-17",
    "Id": "auto-rds-2",
    "Statement": [
        {
            "Sid": "Allow access through RDS for all principals in the account that are authorized to use RDS",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": [
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*",
                "kms:CreateGrant",
                "kms:ListGrants",
                "kms:DescribeKey"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "kms:ViaService": "rds.us-east-1.amazonaws.com",
                    "kms:CallerAccount": "xxxxx"
                }
            }
        },
        {
            "Sid": "Allow direct access to key metadata to the account",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::xxxx:root"
            },
            "Action": [
                "kms:Describe*",
                "kms:Get*",
                "kms:List*",
                "kms:RevokeGrant"
            ],
            "Resource": "*"
        }
    ]
}
已提問 1 年前檢視次數 338 次
2 個答案
0

Thanks for your question, Alex. It is possible that your DB instance was impacted by a recent deprecation. If you file a case with AWS, we will be able to look up your account details, and provide you more accurate information. You can file a case using the steps described here: https://docs.aws.amazon.com/awssupport/latest/user/case-management.html

AWS
palK
已回答 1 年前
0

Thanks very much for your reply.

Unfortunately, our company's account doesn't have support enabled, so I'm not able to file a case.

I was hoping someone had seen this before, and could give me a general idea of what might have happened.

已回答 1 年前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南