All checks
Medium
RDS for SQL Server DB instances should publish logs to CloudWatch Logs
Verifies that RDS for SQL Server DB instances publish the error log to CloudWatch Logs. RDS keeps at most 30 error logs on the instance and may delete any older than seven days, so an incident looked into later has nothing left to read unless the log was already exported.
- service
- RDS
- severity
- Medium
- scope
- evaluated in every region
How to fix it
In the console
RDS → Databases → the SQL Server DB instance → Modify → Log exports
With the AWS CLI
aws rds modify-db-instance --db-instance-identifier <db-instance-identifier> --cloudwatch-logs-export-configuration '{"EnableLogTypes":["error"]}' --region <region>With Terraform
resource "aws_db_instance" "this" {
instance_class = var.instance_class
enabled_cloudwatch_logs_exports = ["error"]
}See which of your accounts this check is failing on.
Book a demo