RDS for MariaDB DB instances should publish logs to CloudWatch Logs

How to fix it

In the console

RDS → Databases → the MariaDB DB instance → Modify → Log exports

Error log

Selected; MariaDB writes this log by default, so nothing else needs to change

With the AWS CLI

aws rds modify-db-instance --db-instance-identifier <db-instance-identifier> --cloudwatch-logs-export-configuration '{"EnableLogTypes":["error"]}' --region <region>

With Terraform

• Overwrites existing settings: enabled_cloudwatch_logs_exports is the complete list, so include every log type the instance already exports or the apply turns the others off.

resource "aws_db_instance" "this" {
  instance_class                  = var.instance_class
  enabled_cloudwatch_logs_exports = ["error"]
}