Check ID: directoryservice_directory_log_forwarding_enabled
Provider: AWS
Service: directoryservice
Severity: MEDIUM
Categories: logging
Resource type: Other

​
What this check verifies

AWS Directory Service directories are configured to forward domain controller security event logs to CloudWatch Logs using log subscriptions. Evaluation identifies directories with or without this forwarding in place.

​
Risk

Without forwarding, visibility into AD security events is lost, delaying detection of suspicious authentications, policy changes, or privilege grants. Attackers can escalate and persist unnoticed, risking unauthorized access (confidentiality) and identity/policy manipulation (integrity), while hampering forensics and response.

​
Recommendation

Enable and maintain log forwarding to CloudWatch Logs.
  • Centralize logs in a protected group with strict access and retention
  • Apply least privilege for delivery roles and readers; prevent tampering (immutability)
  • Alert on high-risk events and aggregate across Regions/accounts for defense in depth

​
Remediation

# Enable Directory Service log forwarding to CloudWatch Logs
resource "aws_cloudwatch_log_group" "ds" {
  name = "/aws/directoryservice/<example_resource_id>"
}

resource "aws_cloudwatch_log_resource_policy" "ds" {
  policy_name     = "DSLogSubscription"
  policy_document = jsonencode({
    Version   = "2012-10-17",
    Statement = [{
      Effect    = "Allow",
      Principal = { Service = "ds.amazonaws.com" },
      Action    = ["logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams"],
      Resource  = "arn:aws:logs:*:*:log-group:/aws/directoryservice/*"
    }]
  })
}

resource "aws_directory_service_log_subscription" "enable" {
  directory_id  = "<example_resource_id>"                 # CRITICAL: enables log forwarding for this directory
  log_group_name = aws_cloudwatch_log_group.ds.name        # CRITICAL: CloudWatch Logs destination
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = directoryservice_directory_log_forwarding_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks