ActiveMQ brokers should stream audit logs to CloudWatch

How to fix it

• Interrupts service: Log changes apply only when the broker reboots, now or in its maintenance window, and a single-instance broker is offline while it reboots.

In the console

Amazon MQ → Brokers → the broker → Edit → CloudWatch Logs

Audit

Selected

When to apply modifications

Immediately (reboots the broker now) or After the next reboot; the check passes once it applies

CloudWatch Logs resource policy

Lets mq.amazonaws.com write to /aws/amazonmq/*; without it no logs arrive, though this check passes

With the AWS CLI

aws mq update-broker --broker-id <broker-id> --logs Audit=true,General=true --region <region>

With Terraform

resource "aws_mq_broker" "this" {
  broker_name        = var.broker_name
  engine_type        = "ActiveMQ"
  engine_version     = var.engine_version
  host_instance_type = var.host_instance_type
  apply_immediately  = true

  logs {
    audit   = true
    general = true
  }
}