All checks
Medium
Aurora MySQL DB clusters should publish audit logs to CloudWatch Logs
Verifies that Aurora MySQL DB clusters publish audit logs to CloudWatch Logs, so the record of logins, data changes and schema changes is kept outside the cluster for review and alarms. A cluster that uploads audit logs through the server_audit_logs_upload parameter instead still fails this check.
- service
- RDS
- severity
- Medium
- scope
- evaluated in every region
How to fix it
In the console
RDS → Databases → the Aurora MySQL cluster → Modify → Log exports
With the AWS CLI
aws rds modify-db-cluster --db-cluster-identifier <db-cluster-identifier> --cloudwatch-logs-export-configuration '{"EnableLogTypes":["audit"]}' --region <region>With Terraform
resource "aws_rds_cluster" "this" {
cluster_identifier = var.cluster_identifier
engine = "aurora-mysql"
enabled_cloudwatch_logs_exports = ["audit"]
}See which of your accounts this check is failing on.
Book a demo