Back to Checks
aws

Neptune cluster has CloudWatch audit logs enabled

neptune_cluster_integration_cloudwatch_logs
Service: neptuneSeverity: medium
OfficialBuilt-inVerified
Categories:loggingforensics-ready
Resource Type:Other

Neptune DB cluster is inspected for CloudWatch export of audit events. The finding indicates whether the cluster publishes audit logs to CloudWatch; a failed status in the report means the audit export is not enabled and audit records are not being forwarded to CloudWatch for centralized logging and review.

Prowler logoProwlerprowler-provider-aws

Risk

Missing audit logs reduces detectability and accountability:

  • Investigators cannot reconstruct queries, client origins, or timeline
  • Unauthorized queries, data exfiltration, or privilege misuse may go undetected

This degrades confidentiality and integrity and slows incident response.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks neptune_cluster_integration_cloudwatch_logs

Recommendation

Enable and centralize audit logging for Neptune by exporting audit events to CloudWatch Logs and integrating with monitoring or SIEM.

  • Enforce least privilege on log access
  • Configure retention, encryption, and alerting for anomalous queries

This supports proactive detection and forensic readiness.

Remediation

CLI

aws neptune modify-db-cluster --db-cluster-identifier <DB_CLUSTER_IDENTIFIER> --cloudwatch-logs-export-configuration '{"EnableLogTypes":["audit"]}'

Terraform

resource "aws_neptune_cluster" "example_resource" {
  cluster_identifier               = "<db_cluster_identifier>"
  enabled_cloudwatch_logs_exports = ["audit"]  # Export audit logs to CloudWatch for monitoring and forensics
}

NativeIaC

Resources:
  NeptuneCluster:
    Type: AWS::Neptune::DBCluster
    Properties:
      DBClusterIdentifier: "<DB_CLUSTER_IDENTIFIER>"
      EnableCloudwatchLogsExports:
        - audit  # Export audit logs to CloudWatch for monitoring and forensics

Other

1Sign in to the AWS Management Console and open Amazon Neptune
2Go to Databases and select the Neptune DB cluster
3Actions > Modify
4In Log exports, check "Audit"
5Continue > Modify DB Cluster

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.neptune.neptune_client import neptune_client


class neptune_cluster_integration_cloudwatch_logs(Check):
    def execute(self):
        findings = []
        for cluster in neptune_client.clusters.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=cluster)
            report.resource_id = cluster.name
            report.status = "FAIL"
            report.status_extended = f"Neptune Cluster {cluster.name} does not have cloudwatch audit logs enabled."
            if "audit" in cluster.cloudwatch_logs:
                report.status = "PASS"
                report.status_extended = (
                    f"Neptune Cluster {cluster.name} has cloudwatch audit logs enabled."
                )

            findings.append(report)

        return findings

References