Amazon Redshift clusters should have audit logging enabled

How to fix it

• Interrupts service: The user activity log stays empty until enable_user_activity_logging is set and the cluster reboots, so schedule that reboot for a quiet period.

In the console

Redshift → Clusters → the cluster → Properties → Database configurations → Edit → Edit audit logging

Edit audit logging

Turn on, with CloudWatch (AWS's recommendation) or S3 bucket as the destination; either passes

Logs to export

Connection log and user log at least, which record sign-ins and changes to database users

enable_user_activity_logging

true in a custom parameter group, only if you also export the user activity log

With the AWS CLI

aws redshift enable-logging --cluster-identifier <cluster-id> --log-destination-type cloudwatch --log-exports connectionlog userlog useractivitylog --region <region>

With Terraform

resource "aws_redshift_logging" "this" {
  cluster_identifier   = var.cluster_identifier
  log_destination_type = "cloudwatch"
  log_exports          = ["connectionlog", "userlog", "useractivitylog"]
}