Neptune DB clusters should publish audit logs to CloudWatch Logs

How to fix it

• Interrupts service: neptune_enable_audit_log takes effect only after every DB instance in the cluster is rebooted, so schedule those reboots for a quiet period.

In the console

Neptune → Databases → the DB cluster → Actions → Modify → Log exports

Audit log

Selected

neptune_enable_audit_log

1 in a custom DB cluster parameter group (the default group cannot be edited); without it the export stays empty

With the AWS CLI

aws neptune modify-db-cluster --db-cluster-identifier <db-cluster-identifier> --cloudwatch-logs-export-configuration '{"EnableLogTypes":["audit"]}' --region <region>

With Terraform

• Overwrites existing settings: enable_cloudwatch_logs_exports is the complete list, so include slowquery too if the cluster already exports it, or the apply turns it off.

resource "aws_neptune_cluster" "this" {
  cluster_identifier             = var.cluster_identifier
  enable_cloudwatch_logs_exports = ["audit"]
}