Back to Checks
aws

Directory Service directory has log forwarding to CloudWatch Logs enabled

directoryservice_directory_log_forwarding_enabled
Service: directoryserviceSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:Other

AWS Directory Service directories are configured to forward domain controller security event logs to CloudWatch Logs using log subscriptions.

Evaluation identifies directories with or without this forwarding in place.

Prowler logoProwlerprowler-provider-aws

Risk

Without forwarding, visibility into AD security events is lost, delaying detection of suspicious authentications, policy changes, or privilege grants. Attackers can escalate and persist unnoticed, risking unauthorized access (confidentiality) and identity/policy manipulation (integrity), while hampering forensics and response.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks directoryservice_directory_log_forwarding_enabled

Recommendation

Enable and maintain log forwarding to CloudWatch Logs.

  • Centralize logs in a protected group with strict access and retention
  • Apply least privilege for delivery roles and readers; prevent tampering (immutability)
  • Alert on high-risk events and aggregate across Regions/accounts for defense in depth

Remediation

Terraform

# Enable Directory Service log forwarding to CloudWatch Logs
resource "aws_cloudwatch_log_group" "ds" {
  name = "/aws/directoryservice/<example_resource_id>"
}

resource "aws_cloudwatch_log_resource_policy" "ds" {
  policy_name     = "DSLogSubscription"
  policy_document = jsonencode({
    Version   = "2012-10-17",
    Statement = [{
      Effect    = "Allow",
      Principal = { Service = "ds.amazonaws.com" },
      Action    = ["logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams"],
      Resource  = "arn:aws:logs:*:*:log-group:/aws/directoryservice/*"
    }]
  })
}

resource "aws_directory_service_log_subscription" "enable" {
  directory_id  = "<example_resource_id>"                 # CRITICAL: enables log forwarding for this directory
  log_group_name = aws_cloudwatch_log_group.ds.name        # CRITICAL: CloudWatch Logs destination
}

NativeIaC

# CloudFormation: enable Directory Service log forwarding to CloudWatch Logs
Resources:
  LogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: /aws/directoryservice/<example_resource_id>

  LogsResourcePolicy:
    Type: AWS::Logs::ResourcePolicy
    Properties:
      PolicyName: DSLogSubscription
      PolicyDocument: |
        {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"ds.amazonaws.com"},"Action":["logs:CreateLogStream","logs:PutLogEvents","logs:DescribeLogStreams"],"Resource":"arn:aws:logs:*:*:log-group:/aws/directoryservice/*"}]}

  DirectoryLogSubscription:
    Type: AWS::DirectoryService::LogSubscription
    Properties:
      DirectoryId: <example_resource_id>          # CRITICAL: target Directory Service ID to enable log forwarding
      LogGroupName: /aws/directoryservice/<example_resource_id>  # CRITICAL: CloudWatch Logs destination

Other

1In the AWS Console, go to Directory Service > Directories and open your directory
2On the Directory details page, select the Networking & security tab
3In Log forwarding, click Enable
4Choose Create a new CloudWatch log group (or select an existing one)
5Click Enable to start forwarding logs

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.directoryservice.directoryservice_client import (
    directoryservice_client,
)


class directoryservice_directory_log_forwarding_enabled(Check):
    def execute(self):
        findings = []
        for directory in directoryservice_client.directories.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=directory)
            if directory.log_subscriptions:
                report.status = "PASS"
                report.status_extended = f"Directory Service {directory.id} have log forwarding to CloudWatch enabled."
            else:
                report.status = "FAIL"
                report.status_extended = f"Directory Service {directory.id} have log forwarding to CloudWatch disabled."

            findings.append(report)

        return findings

References