All checks
Medium
RDS DB instances should publish logs to CloudWatch Logs
Verifies that RDS DB instances publish database logs to CloudWatch Logs, where they are kept for security audits and for diagnosing availability issues. Any one log type the instance's engine offers clears this check. For a member of an Aurora or Multi-AZ DB cluster, the export is set on the cluster.
- service
- RDS
- severity
- Medium
- scope
- evaluated in every region
How to fix it
In the console
RDS → Databases → the DB instance → Modify
With the AWS CLI
aws rds modify-db-instance --db-instance-identifier <db-instance-identifier> --cloudwatch-logs-export-configuration '{"EnableLogTypes":["<log-type>"]}' --region <region>With Terraform
resource "aws_db_instance" "this" {
instance_class = var.instance_class
enabled_cloudwatch_logs_exports = var.log_types
}See which of your accounts this check is failing on.
Book a demo