MQ broker has general and audit logging enabled

Check ID: mq_broker_logging_enabled
Provider: AWS
Service: mq
Severity: LOW
Categories: logging
Resource type: AwsAmazonMQBroker

What this check verifies

Amazon MQ brokers have logging to CloudWatch Logs enabled per engine type: ActiveMQ requires both general and audit logs; RabbitMQ requires general logs.

Risk

Missing broker logs creates blind spots in authentication events, administrative changes, and broker failures. Adversaries can act without detection, enabling unauthorized access and message tampering (confidentiality/integrity) and hindering incident response and root-cause analysis (availability).

Recommendation

Enable centralized CloudWatch Logs for brokers. For ActiveMQ, turn on both general and audit logs; for RabbitMQ, enable general logs. Apply least privilege to log access, set retention, and create alerts for anomalous events to strengthen defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws mq update-broker --broker-id <example_resource_id> --logs Audit=true,General=true

# Terraform: Enable Amazon MQ logging
resource "aws_mq_broker" "<example_resource_name>" {
  broker_name         = "<example_resource_name>"
  engine_type         = "ActiveMQ"
  host_instance_type  = "mq.t3.micro"
  deployment_mode     = "SINGLE_INSTANCE"
  publicly_accessible = true

  user {
    username = "<example_user>"
    password = "<example_password>"
  }

  logs {
    general = true  # Critical: enables general logs
    audit   = true  # Critical: enables audit logs (ActiveMQ)
  }
}

# CloudFormation: Enable Amazon MQ logging
Resources:
  <example_resource_name>:
    Type: AWS::AmazonMQ::Broker
    Properties:
      BrokerName: <example_resource_name>
      EngineType: ACTIVEMQ
      HostInstanceType: mq.t3.micro
      DeploymentMode: SINGLE_INSTANCE
      PubliclyAccessible: true
      Users:
        - Username: <example_user>
          Password: <example_password>
      Logs:
        General: true  # Critical: enables general logs to CloudWatch
        Audit: true    # Critical: enables audit logs (required for ActiveMQ)

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = mq_broker_logging_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

MQ RabbitMQ broker has cluster (multi-AZ) deployment mode Amazon MQ broker is not publicly accessible

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires