Back to Checks
aws

RDS cluster has CloudWatch Logs export enabled

rds_cluster_integration_cloudwatch_logs
Service: rdsSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:AwsRdsDbCluster

RDS clusters running Aurora MySQL, Aurora PostgreSQL, MySQL, or PostgreSQL are assessed for CloudWatch Logs publishing, confirming that database logs are exported to a CloudWatch Logs group.

Prowler logoProwlerprowler-provider-aws

Risk

Without publishing to CloudWatch, database events lack centralized visibility and retention. Brute-force, SQL injection, or privilege misuse may go undetected, hindering forensics and response, risking data confidentiality and integrity and delaying recovery.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks rds_cluster_integration_cloudwatch_logs

Recommendation

Publish RDS/Aurora logs to CloudWatch Logs and centralize analysis. Select appropriate types (e.g., error, general, slowquery, audit), define retention, and create alarms. Limit log access with least privilege and integrate with SIEM for defense-in-depth monitoring.

Remediation

CLI

aws rds modify-db-cluster --db-cluster-identifier <db_cluster_id> --cloudwatch-logs-export-configuration '{"EnableLogTypes":["<engine_supported_log_type>"]}' --apply-immediately

Terraform

# Terraform: Enable CloudWatch Logs export for an RDS/Aurora DB cluster
resource "aws_rds_cluster" "<example_resource_name>" {
  engine            = "<engine>"
  master_username   = "<example_username>"
  master_password   = "<example_password>"

  enabled_cloudwatch_logs_exports = [
    "<engine_supported_log_type>" # CRITICAL: Enables at least one supported log type (e.g., "error" for MySQL or "postgresql" for PostgreSQL) to pass the check
  ]
}

NativeIaC

# CloudFormation: Enable CloudWatch Logs export for an RDS/Aurora DB cluster
Resources:
  <example_resource_name>:
    Type: AWS::RDS::DBCluster
    Properties:
      Engine: <engine>
      MasterUsername: <example_username>
      MasterUserPassword: <example_password>
      EnableCloudwatchLogsExports:
        - <engine_supported_log_type>  # CRITICAL: Enables at least one supported log type (e.g., 'error' for MySQL or 'postgresql' for PostgreSQL) to pass the check

Other

1In the AWS Console, go to RDS > Databases
2Select your DB cluster and choose Modify
3Under Log exports, check at least one supported log type for your engine (e.g., error/general/slowquery/audit for MySQL, postgresql for PostgreSQL)
4Choose Continue, then Apply immediately, and click Modify cluster

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.rds.rds_client import rds_client


class rds_cluster_integration_cloudwatch_logs(Check):
    def execute(self):
        findings = []
        valid_engines = ["aurora-mysql", "aurora-postgresql", "mysql", "postgres"]
        for db_cluster in rds_client.db_clusters.values():
            if db_cluster.engine in valid_engines:
                report = Check_Report_AWS(metadata=self.metadata(), resource=db_cluster)
                if db_cluster.cloudwatch_logs:
                    report.status = "PASS"
                    report.status_extended = f"RDS Cluster {db_cluster.id} is shipping {', '.join(db_cluster.cloudwatch_logs)} logs to CloudWatch Logs."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"RDS Cluster {db_cluster.id} does not have CloudWatch Logs enabled."

                findings.append(report)

        return findings

References