All checks
Medium
ActiveMQ brokers should stream audit logs to CloudWatch
Verifies that Amazon MQ ActiveMQ brokers stream audit logs to CloudWatch Logs, enabling alarm creation and increased visibility into security-related activity.
- service
- MQ
- severity
- Medium
- scope
- evaluated in every region
How to fix it
To remediate ActiveMQ brokers without audit logs streaming to CloudWatch, you need to enable audit logging for the broker.
- Navigate to the Amazon MQ console
- Select the ActiveMQ broker that needs remediation
- Click on 'Edit' or 'Modify' broker
- Go to 'Logs' settings
- Enable 'Audit' logging
- Configure CloudWatch Logs destination
- Set up log groups and retention policies
- Review the logging configuration
- Apply the changes to the broker
- Verify audit logs are streaming to CloudWatch
See which of your accounts this check is failing on.
Book a demo