Control: Neptune DB clusters should publish audit logs to CloudWatch Logs
Description
This control checks whether a Neptune DB cluster publishes audit logs to AWS CloudWatch Logs. The control fails if a Neptune DB cluster doesn't publish audit logs to CloudWatch Logs. EnableCloudWatchLogsExport should be set to Audit.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.neptune_db_cluster_audit_logging_enabledSnapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.neptune_db_cluster_audit_logging_enabled --shareSQL
This control uses a named query:
select arn as resource, engine, case when enabled_cloudwatch_logs_exports @> '["audit"]' then 'ok' else 'alarm' end as status, case when enabled_cloudwatch_logs_exports @> '["audit"]' then title || ' audit logging enabled.' else title || ' audit logging disabled.' end as reason , region, account_idfrom aws_neptune_db_cluster;