Control: DocumentDB instance logging should be enabled
Description
To help with logging and monitoring within your environment, ensure AWS DocumentDB instance logging is enabled.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.docdb_cluster_instance_logging_enabledSnapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.docdb_cluster_instance_logging_enabled --shareSQL
This control uses a named query:
select db_instance_arn as resource, engine, case when engine like 'docdb' and enabled_cloudwatch_logs_exports ?& array ['error', 'slowquery'] then 'ok' else 'alarm' end as status, case when engine like 'docdb' and enabled_cloudwatch_logs_exports ?& array ['error', 'slowquery'] then title || ' ' || engine || ' logging enabled.' else title || ' logging not enabled.' end as reason , region, account_idfrom aws_docdb_cluster_instance;