Neptune cluster has CloudWatch audit logs enabled

Check ID: neptune_cluster_integration_cloudwatch_logs
Provider: AWS
Service: neptune
Severity: MEDIUM
Categories: logging, forensics-ready
Resource type: Other

What this check verifies

Neptune DB cluster is inspected for CloudWatch export of audit events. The finding indicates whether the cluster publishes audit logs to CloudWatch; a failed status in the report means the audit export is not enabled and audit records are not being forwarded to CloudWatch for centralized logging and review.

Risk

Missing audit logs reduces detectability and accountability:

Investigators cannot reconstruct queries, client origins, or timeline
Unauthorized queries, data exfiltration, or privilege misuse may go undetected

This degrades confidentiality and integrity and slows incident response.

Recommendation

Enable and centralize audit logging for Neptune by exporting audit events to CloudWatch Logs and integrating with monitoring or SIEM.

Enforce least privilege on log access
Configure retention, encryption, and alerting for anomalous queries

This supports proactive detection and forensic readiness.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws neptune modify-db-cluster --db-cluster-identifier <DB_CLUSTER_IDENTIFIER> --cloudwatch-logs-export-configuration '{"EnableLogTypes":["audit"]}'

resource "aws_neptune_cluster" "example_resource" {
  cluster_identifier               = "<db_cluster_identifier>"
  enabled_cloudwatch_logs_exports = ["audit"]  # Export audit logs to CloudWatch for monitoring and forensics
}

Resources:
  NeptuneCluster:
    Type: AWS::Neptune::DBCluster
    Properties:
      DBClusterIdentifier: "<DB_CLUSTER_IDENTIFIER>"
      EnableCloudwatchLogsExports:
        - audit  # Export audit logs to CloudWatch for monitoring and forensics

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = neptune_cluster_integration_cloudwatch_logs. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Neptune cluster has IAM authentication enabled Neptune cluster has Multi-AZ enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires