All checks
Medium
RDS for PostgreSQL DB instances should publish logs to CloudWatch Logs
Verifies that RDS for PostgreSQL DB instances publish the postgresql log to CloudWatch Logs, where it is kept durably and can be searched and alarmed on. The export does not decide what is logged: log_statement and log_min_duration_statement in the parameter group do. For a member of a Multi-AZ DB cluster, the export is set on the cluster.
- service
- RDS
- severity
- Medium
- scope
- evaluated in every region
How to fix it
In the console
RDS → Databases → the PostgreSQL DB instance → Modify → Log exports
- PostgreSQL log
- Selected; the upgrade and IAM database authentication error logs do not clear this check
With the AWS CLI
aws rds modify-db-instance --db-instance-identifier <db-instance-identifier> --cloudwatch-logs-export-configuration '{"EnableLogTypes":["postgresql"]}' --region <region>With Terraform
- Overwrites existing settings: enabled_cloudwatch_logs_exports is the complete list, so include every log type the instance already exports or the apply turns the others off.
resource "aws_db_instance" "this" {
instance_class = var.instance_class
enabled_cloudwatch_logs_exports = ["postgresql"]
}See which of your accounts this check is failing on.
Book a live scan