Back to Checks
aws

RDS instance exports logs to CloudWatch Logs

rds_instance_integration_cloudwatch_logs
Service: rdsSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:AwsRdsDbInstance

RDS DB instances are configured to publish database logs to CloudWatch Logs (e.g., error, general, slowquery, audit).

The evaluation identifies instances that have log exports enabled to a CloudWatch log group.

Prowler logoProwlerprowler-provider-aws

Risk

Without centralized RDS logs, database activity lacks visibility, hindering detection and response. Credential misuse, SQL injection, data exfiltration, and privilege abuse may go unnoticed, risking confidentiality and integrity. Unseen errors and slow queries can lead to outages, impacting availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks rds_instance_integration_cloudwatch_logs

Recommendation

Enable export of relevant RDS logs to CloudWatch Logs (error, general, slowquery, audit) and standardize across engines. Enforce least privilege on log access, set retention, and define metrics/alarms for critical patterns. Integrate with a SIEM. Apply separation of duties and defense in depth to protect log integrity and monitoring.

Remediation

CLI

aws rds modify-db-instance --db-instance-identifier <db_instance_id> --cloudwatch-logs-export-configuration '{"EnableLogTypes":["<log_type>"]}'

Terraform

resource "aws_db_instance" "<example_resource_name>" {
  identifier = "<example_resource_id>"
  # Critical: export at least one supported log type to CloudWatch Logs to pass the check
  enabled_cloudwatch_logs_exports = ["<log_type>"]
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::RDS::DBInstance
    Properties:
      DBInstanceIdentifier: <example_resource_id>
      # Critical: enabling at least one log type exports it to CloudWatch Logs and makes the check PASS
      EnableCloudwatchLogsExports:
        - <log_type>

Other

1Open AWS Console > RDS > Databases
2Select your DB instance and choose Modify
3In Log exports, select at least one supported log type (e.g., error/general/slowquery/audit/postgresql/alert)
4Choose Continue, then Modify DB instance

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.rds.rds_client import rds_client


class rds_instance_integration_cloudwatch_logs(Check):
    def execute(self):
        findings = []
        for db_instance in rds_client.db_instances.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=db_instance)
            if db_instance.cloudwatch_logs:
                report.status = "PASS"
                report.status_extended = f"RDS Instance {db_instance.id} is shipping {', '.join(db_instance.cloudwatch_logs)} logs to CloudWatch Logs."
            else:
                report.status = "FAIL"
                report.status_extended = f"RDS Instance {db_instance.id} does not have CloudWatch Logs enabled."

            findings.append(report)

        return findings

References