All checks
Medium
RDS for PostgreSQL DB instances should publish logs to CloudWatch Logs
Verifies that RDS for PostgreSQL DB instances publish the postgresql log to CloudWatch Logs, where it is kept durably and can be searched and alarmed on. The export does not decide what is logged: log_statement and log_min_duration_statement in the parameter group do. For a member of a Multi-AZ DB cluster, the export is set on the cluster.
- service
- RDS
- severity
- Medium
- scope
- evaluated in every region
How to fix it
In the console
RDS → Databases → the PostgreSQL DB instance → Modify → Log exports
With the AWS CLI
aws rds modify-db-instance --db-instance-identifier <db-instance-identifier> --cloudwatch-logs-export-configuration '{"EnableLogTypes":["postgresql"]}' --region <region>With Terraform
resource "aws_db_instance" "this" {
instance_class = var.instance_class
enabled_cloudwatch_logs_exports = ["postgresql"]
}See which of your accounts this check is failing on.
Book a demo