Amazon Redshift clusters should have audit logging enabled

How to fix it

Turn on audit logging for the cluster, to CloudWatch Logs or an S3 bucket, so connection attempts and changes to database users are recorded outside the database. Either destination clears this. If you also select the user activity log, it stays empty until enable_user_activity_logging is set in the cluster parameter group and the cluster restarts.

In the console

Redshift → Clusters → the cluster → Properties → Database configurations → Edit → Edit audit logging

With the AWS CLI

aws redshift enable-logging --cluster-identifier <cluster-id> --log-destination-type cloudwatch --log-exports connectionlog userlog useractivitylog --region <region>

With Terraform

resource "aws_redshift_logging" "this" {
  cluster_identifier   = var.cluster_identifier
  log_destination_type = "cloudwatch"
  log_exports          = ["connectionlog", "userlog", "useractivitylog"]
}