AWS RDS MSSQL logs so many failed login attempts

Question

Am pretty new to AWS. I have created RDS with MSSQL express edition and restored few databases into the server with public accessibility as YES and port 1433 and inbound rule allows everyone(0.0.0.0/0) .. after sometime I have observed some fishy login attempts from from different IP addresses. in db logs in monitoring section Is that mean someone trying to get access to my database??

2021-07-01 13:36:27.99 Logon       Login failed for user 'sa'. Reason: Could not find a login 
matching the name provided. [CLIENT: 103.41.65.227]

Is this expected, can someone throw some light on it.

Answer 1

Observing log files
When you look at a log in the Amazon RDS console, you may see the contents as they are right now. When you watch a log on the console, it becomes dynamic, allowing you to see updates in real time.

Only the most recent log is available for viewing. As an example, let's say you have the following logs:

Log files are archived.
The Amazon RDS console displays logs from the previous week to the present day. You can download and archive logs to save them for future reference. Loading logs into an Amazon S3 bucket is one technique to archive them.

Error and agent logs are available for viewing.
Using the Amazon RDS stored procedure rds read error log and the following parameters, you can examine Microsoft SQL Server error and agent logs.

The version of the log to obtain is specified by @index. The current error log is retrieved by default, which is 0. Choose 1 for the preceding log, 2 for the one before that, and so on.

The type of log to obtain is specified by the @type parameter. To get an error log, use the 1 parameter. To get an agent log, use the 2 parameter.

If you need to know more about MSSQL, it is recommended to go for the SQL Course today.