DocumentDB exports audit and profiler logs to CloudWatch

Check ID: documentdb_cluster_cloudwatch_log_export
Provider: AWS
Service: documentdb
Severity: MEDIUM
Categories: logging
Resource type: AwsRdsDbCluster

What this check verifies

Amazon DocumentDB clusters are evaluated for exporting audit and profiler logs to CloudWatch Logs. Clusters missing one or both log types are identified as lacking complete log export configuration.

Risk

Missing audit and/or profiler exports reduces observability of authentication, authorization, and data definition activity. Attacks like brute-force logins, privilege abuse, or destructive schema changes can go unnoticed, degrading confidentiality and integrity and delaying incident response.

Recommendation

Enable export of both audit and profiler logs to CloudWatch Logs for all clusters and centralize analysis. Apply least privilege to log access, define retention and immutability, integrate with alerting, and use separation of duties to protect and regularly review logs for defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws docdb modify-db-cluster --db-cluster-identifier <DB_CLUSTER_ID> --cloudwatch-logs-export-configuration '{"EnableLogTypes":["audit","profiler"]}' --apply-immediately

# Enable DocumentDB log exports
resource "aws_docdb_cluster" "<example_resource_name>" {
  enabled_cloudwatch_logs_exports = ["audit", "profiler"] # Critical: export both logs to CloudWatch Logs
}

# CloudFormation: enable DocumentDB log exports
Resources:
  <example_resource_name>:
    Type: AWS::DocDB::DBCluster
    Properties:
      EnableCloudwatchLogsExports:
        - audit      # Critical: export audit logs to CloudWatch Logs
        - profiler   # Critical: export profiler logs to CloudWatch Logs

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = documentdb_cluster_cloudwatch_log_export. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

DocumentDB cluster keeps backups for 7 days or more DocumentDB cluster has deletion protection enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires