DataSync tasks should have logging enabled

Checks that the DataSync task publishes logs to CloudWatch Logs, recording transfer errors or every file moved and verified, for investigations and audits. A task with logging off fails, and so does a Basic mode task with no CloudWatch log group, because its logs have nowhere to go.

service: DataSync
severity: Medium
scope: evaluated in every region

How to fix it

In the console

DataSync → Data transfer → Tasks → the task → Edit

Log level: Log basic information such as transfer errors, or Log all transferred objects and files
CloudWatch log group: Autogenerate, or one DataSync may write to; Enhanced mode tasks use /aws/datasync

With the AWS CLI

aws datasync update-task --task-arn <task-arn> --options LogLevel=BASIC --cloud-watch-log-group-arn <log-group-arn> --region <region>

With Terraform

resource "aws_datasync_task" "this" {
  source_location_arn      = var.source_location_arn
  destination_location_arn = var.destination_location_arn
  cloudwatch_log_group_arn = var.log_group_arn

  options {
    log_level = "BASIC"
  }
}

See which of your accounts this check is failing on.

Book a live scan