Back to Checks
aws

MQ broker has general logging enabled and, for ActiveMQ, audit logging enabled

mq_broker_logging_enabled
Service: mqSeverity: low
OfficialBuilt-inVerified
Categories:logging
Resource Type:AwsAmazonMQBroker

Amazon MQ brokers have logging to CloudWatch Logs enabled per engine type: ActiveMQ requires both general and audit logs; RabbitMQ requires general logs.

Prowler logoProwlerprowler-provider-aws

Risk

Missing broker logs creates blind spots in authentication events, administrative changes, and broker failures. Adversaries can act without detection, enabling unauthorized access and message tampering (confidentiality/integrity) and hindering incident response and root-cause analysis (availability).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks mq_broker_logging_enabled

Recommendation

Enable centralized CloudWatch Logs for brokers. For ActiveMQ, turn on both general and audit logs; for RabbitMQ, enable general logs.

Apply least privilege to log access, set retention, and create alerts for anomalous events to strengthen defense in depth.

Remediation

CLI

aws mq update-broker --broker-id <example_resource_id> --logs Audit=true,General=true

Terraform

# Terraform: Enable Amazon MQ logging
resource "aws_mq_broker" "<example_resource_name>" {
  broker_name         = "<example_resource_name>"
  engine_type         = "ActiveMQ"
  host_instance_type  = "mq.t3.micro"
  deployment_mode     = "SINGLE_INSTANCE"
  publicly_accessible = true

  user {
    username = "<example_user>"
    password = "<example_password>"
  }

  logs {
    general = true  # Critical: enables general logs
    audit   = true  # Critical: enables audit logs (ActiveMQ)
  }
}

NativeIaC

# CloudFormation: Enable Amazon MQ logging
Resources:
  <example_resource_name>:
    Type: AWS::AmazonMQ::Broker
    Properties:
      BrokerName: <example_resource_name>
      EngineType: ACTIVEMQ
      HostInstanceType: mq.t3.micro
      DeploymentMode: SINGLE_INSTANCE
      PubliclyAccessible: true
      Users:
        - Username: <example_user>
          Password: <example_password>
      Logs:
        General: true  # Critical: enables general logs to CloudWatch
        Audit: true    # Critical: enables audit logs (required for ActiveMQ)

Other

1In the AWS Console, go to Amazon MQ > Brokers
2Select <example_resource_name> and choose Edit
3In Log settings:
4- For ActiveMQ: enable General logs and Audit logs
5- For RabbitMQ: enable General logs only
6Save changes and reboot if prompted

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.mq.mq_client import mq_client
from prowler.providers.aws.services.mq.mq_service import EngineType


class mq_broker_logging_enabled(Check):
    """Ensure that MQ Brokers have logging enabled

    This check will return FAIL if the MQ Broker does not have logging enabled.
    """

    def execute(self):
        """Execute the check

        Returns: List[Check_Report_AWS]: List of check reports
        """
        findings = []
        for broker in mq_client.brokers.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=broker)
            report.status = "FAIL"
            report.status_extended = (
                f"MQ Broker {broker.name} does not have logging enabled."
            )
            logging_enabled = False

            if broker.engine_type == EngineType.ACTIVEMQ:
                logging_enabled = (
                    broker.general_logging_enabled and broker.audit_logging_enabled
                )
            elif broker.engine_type == EngineType.RABBITMQ:
                logging_enabled = broker.general_logging_enabled

            if logging_enabled:
                report.status = "PASS"
                report.status_extended = (
                    f"MQ Broker {broker.name} does have logging enabled."
                )

            findings.append(report)

        return findings

References