Amazon Connect instances should have CloudWatch logging enabled

Checks that an Amazon Connect instance has flow logs turned on, which sends events from its flows to a CloudWatch log group for finding errors, monitoring and alerting. A flow writes logs only where a Set logging behavior block enables it, and this check does not read flows.

service: Connect
severity: Medium
scope: evaluated in every region

How to fix it

In the console

Amazon Connect → the instance alias → Flows

Enable Flow logs: Selected
Set logging behavior: A block set to Enable in each flow to log; publish the flow again if it was already published

With the AWS CLI

aws connect update-instance-attribute --instance-id <instance-id> --attribute-type CONTACTFLOW_LOGS --value true --region <region>

With Terraform

resource "aws_connect_instance" "this" {
  identity_management_type  = var.identity_management_type
  instance_alias            = var.instance_alias
  inbound_calls_enabled     = var.inbound_calls_enabled
  outbound_calls_enabled    = var.outbound_calls_enabled
  contact_flow_logs_enabled = true
}

See which of your accounts this check is failing on.

Book a live scan