Control: 4 Amazon DocumentDB clusters should publish audit logs to CloudWatch Logs
Description
This control checks whether an Amazon DocumentDB cluster publishes audit logs to Amazon CloudWatch Logs. The control fails if the cluster doesn't publish audit logs to CloudWatch Logs.
Amazon DocumentDB (with MongoDB compatibility) allows you to audit events that were performed in your cluster. Examples of logged events include successful and failed authentication attempts, dropping a collection in a database, or creating an index. By default, auditing is disabled in Amazon DocumentDB and requires that you take action to enable it.
Remediation
To publish Amazon DocumentDB audit logs to CloudWatch Logs, see Enabling auditing in the Amazon DocumentDB Developer Guide.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.foundational_security_docdb_4Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.foundational_security_docdb_4 --shareSQL
This control uses a named query:
select db_instance_arn as resource, engine, case when engine like 'docdb' and enabled_cloudwatch_logs_exports ?& array ['error', 'slowquery'] then 'ok' else 'alarm' end as status, case when engine like 'docdb' and enabled_cloudwatch_logs_exports ?& array ['error', 'slowquery'] then title || ' ' || engine || ' logging enabled.' else title || ' logging not enabled.' end as reason , region, account_idfrom aws_docdb_cluster_instance;