Medium
Identify
Regional
MSK connectors should have logging enabled
FSBP
Description
This control checks whether logging is enabled for an Amazon MSK connector. The control fails if logging is disabled for the MSK connector. Amazon MSK connectors integrate external systems and Amazon services with Apache Kafka by continuously copying streaming data from a data source into an Apache Kafka cluster, or continuously copying data from a cluster into a data sink. MSK Connect can write log events that can help debug a connector. When you create a connector, you can specify zero or more of the following log destinations: Amazon CloudWatch Logs, Amazon S3, and Amazon Data Firehose.
Remediation
To remediate MSK connectors without logging enabled, you need to enable logging for the connector.
Steps
- Navigate to the Amazon MSK Connect console
- Select the connector that needs remediation
- Click on 'Edit' or 'Modify' connector
- Go to 'Logging' settings
- Enable one or more log destinations
- Configure CloudWatch Logs, S3, or Firehose logging
- Set up log groups and retention policies
- Review the logging configuration
- Apply the changes to the connector
- Verify logging is working and generating logs
Compliance
FSBP