Control: 4 Amazon DocumentDB clusters should publish audit logs to CloudWatch Logs
Description
This control checks whether an Amazon DocumentDB cluster publishes audit logs to Amazon CloudWatch Logs. The control fails if the cluster doesn't publish audit logs to CloudWatch Logs.
Amazon DocumentDB (with MongoDB compatibility) allows you to audit events that were performed in your cluster. Examples of logged events include successful and failed authentication attempts, dropping a collection in a database, or creating an index. By default, auditing is disabled in Amazon DocumentDB and requires that you take action to enable it.
Remediation
To publish Amazon DocumentDB audit logs to CloudWatch Logs, see Enabling auditing in the Amazon DocumentDB Developer Guide.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.foundational_security_docdb_4Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.foundational_security_docdb_4 --shareSQL
This control uses a named query:
docdb_cluster_instance_logging_enabled