RDS cluster has CloudWatch Logs export enabled

Check ID: rds_cluster_integration_cloudwatch_logs
Provider: AWS
Service: rds
Severity: MEDIUM
Categories: logging
Resource type: AwsRdsDbCluster

What this check verifies

RDS clusters running Aurora MySQL, Aurora PostgreSQL, MySQL, or PostgreSQL are assessed for CloudWatch Logs publishing, confirming that database logs are exported to a CloudWatch Logs group.

Risk

Without publishing to CloudWatch, database events lack centralized visibility and retention. Brute-force, SQL injection, or privilege misuse may go undetected, hindering forensics and response, risking data confidentiality and integrity and delaying recovery.

Recommendation

Publish RDS/Aurora logs to CloudWatch Logs and centralize analysis. Select appropriate types (e.g., error, general, slowquery, audit), define retention, and create alarms. Limit log access with least privilege and integrate with SIEM for defense-in-depth monitoring.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws rds modify-db-cluster --db-cluster-identifier <db_cluster_id> --cloudwatch-logs-export-configuration '{"EnableLogTypes":["<engine_supported_log_type>"]}' --apply-immediately

# Terraform: Enable CloudWatch Logs export for an RDS/Aurora DB cluster
resource "aws_rds_cluster" "<example_resource_name>" {
  engine            = "<engine>"
  master_username   = "<example_username>"
  master_password   = "<example_password>"

  enabled_cloudwatch_logs_exports = [
    "<engine_supported_log_type>" # CRITICAL: Enables at least one supported log type (e.g., "error" for MySQL or "postgresql" for PostgreSQL) to pass the check
  ]
}

# CloudFormation: Enable CloudWatch Logs export for an RDS/Aurora DB cluster
Resources:
  <example_resource_name>:
    Type: AWS::RDS::DBCluster
    Properties:
      Engine: <engine>
      MasterUsername: <example_username>
      MasterUserPassword: <example_password>
      EnableCloudwatchLogsExports:
        - <engine_supported_log_type>  # CRITICAL: Enables at least one supported log type (e.g., 'error' for MySQL or 'postgresql' for PostgreSQL) to pass the check

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = rds_cluster_integration_cloudwatch_logs. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

RDS cluster has IAM authentication enabled RDS cluster has automatic minor version upgrades enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires