Back to Checks
aws

DocumentDB cluster exports audit and profiler logs to CloudWatch Logs

documentdb_cluster_cloudwatch_log_export
Service: documentdbSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:AwsRdsDbCluster

Amazon DocumentDB clusters are evaluated for exporting audit and profiler logs to CloudWatch Logs. Clusters missing one or both log types are identified as lacking complete log export configuration.

Prowler logoProwlerprowler-provider-aws

Risk

Missing audit and/or profiler exports reduces observability of authentication, authorization, and data definition activity. Attacks like brute-force logins, privilege abuse, or destructive schema changes can go unnoticed, degrading confidentiality and integrity and delaying incident response.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks documentdb_cluster_cloudwatch_log_export

Recommendation

Enable export of both audit and profiler logs to CloudWatch Logs for all clusters and centralize analysis. Apply least privilege to log access, define retention and immutability, integrate with alerting, and use separation of duties to protect and regularly review logs for defense in depth.

Remediation

CLI

aws docdb modify-db-cluster --db-cluster-identifier <DB_CLUSTER_ID> --cloudwatch-logs-export-configuration '{"EnableLogTypes":["audit","profiler"]}' --apply-immediately

Terraform

# Enable DocumentDB log exports
resource "aws_docdb_cluster" "<example_resource_name>" {
  enabled_cloudwatch_logs_exports = ["audit", "profiler"] # Critical: export both logs to CloudWatch Logs
}

NativeIaC

# CloudFormation: enable DocumentDB log exports
Resources:
  <example_resource_name>:
    Type: AWS::DocDB::DBCluster
    Properties:
      EnableCloudwatchLogsExports:
        - audit      # Critical: export audit logs to CloudWatch Logs
        - profiler   # Critical: export profiler logs to CloudWatch Logs

Other

1In AWS Console, go to Amazon DocumentDB > Clusters
2Select the cluster and choose Actions > Modify
3In Log exports, check Audit and Profiler
4Check Apply immediately and click Modify cluster

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS, Severity
from prowler.providers.aws.services.documentdb.documentdb_client import (
    documentdb_client,
)


class documentdb_cluster_cloudwatch_log_export(Check):
    def execute(self):
        findings = []
        for cluster in documentdb_client.db_clusters.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=cluster)
            report.status = "FAIL"
            report.status_extended = f"DocumentDB Cluster {cluster.id} does not have cloudwatch log export enabled."
            if cluster.cloudwatch_logs:
                if (
                    "audit" in cluster.cloudwatch_logs
                    and "profiler" in cluster.cloudwatch_logs
                ):
                    report.status = "PASS"
                    report.status_extended = f"DocumentDB Cluster {cluster.id} is shipping {' '.join(cluster.cloudwatch_logs)} to CloudWatch Logs."
                elif (
                    "audit" in cluster.cloudwatch_logs
                    or "profiler" in cluster.cloudwatch_logs
                ):
                    report.status = "FAIL"
                    report.check_metadata.Severity = Severity.low
                    report.status_extended = f"DocumentDB Cluster {cluster.id} is only shipping {' '.join(cluster.cloudwatch_logs)} to CloudWatch Logs. Recommended to ship both Audit and Profiler logs."

            findings.append(report)

        return findings

References