All checks
Medium
Amazon DocumentDB clusters should publish audit logs to CloudWatch Logs
Checks that a DocumentDB cluster exports audit logs to CloudWatch Logs, so authentication attempts, dropped collections, new indexes and user changes are recorded outside the cluster. It reads only the export: with the audit_logs cluster parameter left at none or disabled, a passing cluster sends no audit events.
- service
- DocumentDB
- severity
- Medium
- scope
- evaluated in every region
How to fix it
In the console
Amazon DocumentDB → Clusters → the cluster → Actions → Modify → Log exports
- Audit logs
- Selected
- audit_logs
- all, or the events you need from ddl, dml_read and dml_write, in a custom cluster parameter group
With the AWS CLI
aws docdb modify-db-cluster --db-cluster-identifier <cluster-identifier> --cloudwatch-logs-export-configuration '{"EnableLogTypes":["audit"]}' --region <region>With Terraform
- Overwrites existing settings: enabled_cloudwatch_logs_exports is the complete list, so include profiler if the cluster already exports it or the apply turns it off.
resource "aws_docdb_cluster" "this" {
cluster_identifier = var.cluster_identifier
enabled_cloudwatch_logs_exports = ["audit"]
}See which of your accounts this check is failing on.
Book a live scan