Aurora MySQL DB clusters should have audit logging enabled

How to fix it

• Interrupts service: A default cluster parameter group cannot be edited, so a cluster on one needs a custom group in its family, and a newly attached group takes effect only after a reboot.
• Affects another check: This makes the engine write audit records; they reach CloudWatch Logs only through the cluster's audit log export, which RDS.34 checks.

In the console

RDS → Parameter groups → the DB cluster parameter group attached to the cluster

server_audit_logging

1

server_audit_events

The events to record, such as CONNECT,QUERY_DDL; left empty, the engine records nothing

With the AWS CLI

aws rds modify-db-cluster-parameter-group --db-cluster-parameter-group-name <db-cluster-parameter-group-name> --parameters ParameterName=server_audit_logging,ParameterValue=1,ApplyMethod=immediate --region <region>

With Terraform

resource "aws_rds_cluster_parameter_group" "this" {
  name   = var.parameter_group_name
  family = var.family

  parameter {
    name  = "server_audit_logging"
    value = "1"
  }
}