Aurora MySQL DB clusters should publish audit logs to CloudWatch Logs

How to fix it

• Affects another check: The export carries only what the engine writes, so also set server_audit_logging to 1 in the cluster parameter group, which RDS.45 checks.

In the console

RDS → Databases → the Aurora MySQL cluster → Modify → Log exports

Audit log

Selected

With the AWS CLI

aws rds modify-db-cluster --db-cluster-identifier <db-cluster-identifier> --cloudwatch-logs-export-configuration '{"EnableLogTypes":["audit"]}' --region <region>

With Terraform

• Overwrites existing settings: enabled_cloudwatch_logs_exports is the complete list, so include every log type the cluster already exports or the apply turns the others off.

resource "aws_rds_cluster" "this" {
  cluster_identifier              = var.cluster_identifier
  engine                          = "aurora-mysql"
  enabled_cloudwatch_logs_exports = ["audit"]
}