Back to Checks
aws

DataSync task has CloudWatch Logs log group configured for logging

datasync_task_logging_enabled
Service: datasyncSeverity: high
OfficialBuilt-inVerified
Categories:logging
Resource Type:Other

AWS DataSync tasks are evaluated for a configured CloudWatch Logs destination (CloudWatchLogGroupArn).

Tasks that specify a log group are recognized as logging-enabled; those without one are identified as not publishing execution events.

Prowler logoProwlerprowler-provider-aws

Risk

Absent DataSync task logs create blind spots, preventing timely detection of failed or partial transfers, unexpected deletions, or anomalies. This undermines data integrity verification, obscures potential exfiltration indicators, and slows forensics and recovery, reducing availability during incidents.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks datasync_task_logging_enabled

Recommendation

Configure each task to publish logs to a dedicated CloudWatch Logs group. Select an appropriate log level (e.g., BASIC or TRANSFER), enforce least privilege for log access, set retention and immutability, and integrate alerts. Centralize and monitor logs to support defense in depth and incident response.

Remediation

CLI

aws datasync update-task --task-arn <task-arn> --cloud-watch-log-group-arn <log-group-arn>

Terraform

# Enable CloudWatch Logs for a DataSync task
resource "aws_datasync_task" "<example_resource_name>" {
  source_location_arn      = "<example_source_location_arn>"
  destination_location_arn = "<example_destination_location_arn>"
  cloudwatch_log_group_arn = "<example_log_group_arn>"  # Critical: attaches a CloudWatch Logs group to enable task logging
}

NativeIaC

# CloudFormation: Enable CloudWatch Logs for a DataSync task
Resources:
  <example_resource_name>:
    Type: AWS::DataSync::Task
    Properties:
      SourceLocationArn: <example_source_location_arn>
      DestinationLocationArn: <example_destination_location_arn>
      CloudWatchLogGroupArn: <example_log_group_arn>  # Critical: attaches a CloudWatch Logs group to enable task logging

Other

1In the AWS Console, go to DataSync > Tasks
2Select the task and click Edit
3In the Logging section, set CloudWatch Log group to an existing log group
4Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.datasync.datasync_client import datasync_client


class datasync_task_logging_enabled(Check):
    """Check if AWS DataSync tasks have logging enabled.

    This class verifies whether each AWS DataSync task has logging enabled by checking
    for the presence of a CloudWatch Log Group ARN in the task's configuration.
    """

    def execute(self) -> List[Check_Report_AWS]:
        """Execute the DataSync tasks logging enabled check.

        Iterates over all DataSync tasks and generates a report indicating whether
        each task has logging enabled.

        Returns:
            List[Check_Report_AWS]: A list of report objects with the results of the check.
        """
        findings = []
        for task in datasync_client.tasks.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=task)
            report.status = "PASS"
            report.status_extended = f"DataSync task {task.name} has logging enabled."

            if not task.cloudwatch_log_group_arn:
                report.status = "FAIL"
                report.status_extended = (
                    f"DataSync task {task.name} does not have logging enabled."
                )

            findings.append(report)
        return findings

References