RDS instance exports logs to CloudWatch Logs

Check ID: rds_instance_integration_cloudwatch_logs
Provider: AWS
Service: rds
Severity: MEDIUM
Categories: logging
Resource type: AwsRdsDbInstance

What this check verifies

RDS DB instances are configured to publish database logs to CloudWatch Logs (e.g., error, general, slowquery, audit). The evaluation identifies instances that have log exports enabled to a CloudWatch log group.

Risk

Without centralized RDS logs, database activity lacks visibility, hindering detection and response. Credential misuse, SQL injection, data exfiltration, and privilege abuse may go unnoticed, risking confidentiality and integrity. Unseen errors and slow queries can lead to outages, impacting availability.

Recommendation

Enable export of relevant RDS logs to CloudWatch Logs (error, general, slowquery, audit) and standardize across engines. Enforce least privilege on log access, set retention, and define metrics/alarms for critical patterns. Integrate with a SIEM. Apply separation of duties and defense in depth to protect log integrity and monitoring.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws rds modify-db-instance --db-instance-identifier <db_instance_id> --cloudwatch-logs-export-configuration '{"EnableLogTypes":["<log_type>"]}'

resource "aws_db_instance" "<example_resource_name>" {
  identifier = "<example_resource_id>"
  # Critical: export at least one supported log type to CloudWatch Logs to pass the check
  enabled_cloudwatch_logs_exports = ["<log_type>"]
}

Resources:
  <example_resource_name>:
    Type: AWS::RDS::DBInstance
    Properties:
      DBInstanceIdentifier: <example_resource_id>
      # Critical: enabling at least one log type exports it to CloudWatch Logs and makes the check PASS
      EnableCloudwatchLogsExports:
        - <log_type>

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = rds_instance_integration_cloudwatch_logs. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

RDS instance is deployed in a VPC RDS instance has minor version upgrade enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires