DataSync task logs to a CloudWatch Logs log group

Check ID: datasync_task_logging_enabled
Provider: AWS
Service: datasync
Severity: HIGH
Categories: logging
Resource type: Other

What this check verifies

AWS DataSync tasks are evaluated for a configured CloudWatch Logs destination (CloudWatchLogGroupArn). Tasks that specify a log group are recognized as logging-enabled; those without one are identified as not publishing execution events.

Risk

Absent DataSync task logs create blind spots, preventing timely detection of failed or partial transfers, unexpected deletions, or anomalies. This undermines data integrity verification, obscures potential exfiltration indicators, and slows forensics and recovery, reducing availability during incidents.

Recommendation

Configure each task to publish logs to a dedicated CloudWatch Logs group. Select an appropriate log level (e.g., BASIC or TRANSFER), enforce least privilege for log access, set retention and immutability, and integrate alerts. Centralize and monitor logs to support defense in depth and incident response.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws datasync update-task —task-arn <task-arn> —cloud-watch-log-group-arn <log-group-arn>

# Enable CloudWatch Logs for a DataSync task
resource "aws_datasync_task" "<example_resource_name>" {
  source_location_arn      = "<example_source_location_arn>"
  destination_location_arn = "<example_destination_location_arn>"
  cloudwatch_log_group_arn = "<example_log_group_arn>"  # Critical: attaches a CloudWatch Logs group to enable task logging
}

# CloudFormation: Enable CloudWatch Logs for a DataSync task
Resources:
  <example_resource_name>:
    Type: AWS::DataSync::Task
    Properties:
      SourceLocationArn: <example_source_location_arn>
      DestinationLocationArn: <example_destination_location_arn>
      CloudWatchLogGroupArn: <example_log_group_arn>  # Critical: attaches a CloudWatch Logs group to enable task logging

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = datasync_task_logging_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

AWS Config recorder uses the service-linked role Direct Connect spans two or more locations per region

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires