RDS DB instances should publish logs to CloudWatch Logs

How to fix it

In the console

RDS → Databases → the DB instance → Modify

Log exports

At least one log type, for example error on MySQL, MariaDB or SQL Server, or postgresql on PostgreSQL

With the AWS CLI

aws rds modify-db-instance --db-instance-identifier <db-instance-identifier> --cloudwatch-logs-export-configuration '{"EnableLogTypes":["<log-type>"]}' --region <region>

With Terraform

• Overwrites existing settings: enabled_cloudwatch_logs_exports is the complete list, so include every log type the instance already exports or the apply turns the others off.

resource "aws_db_instance" "this" {
  instance_class                  = var.instance_class
  enabled_cloudwatch_logs_exports = var.log_types
}