> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging.md). # Logging | Rule Name | AppSec Rule ID | Severity | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------ | -------- | | [Alibaba Cloud Action Trail Logging is not enabled for all regions misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-ali-4.md) | APPSEC\_ALI\_4 | MEDIUM | | [Alibaba Cloud Action Trail Logging is not enabled for all events misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-ali-5.md) | APPSEC\_ALI\_5 | MEDIUM | | [Alibaba Cloud OSS bucket has access logging enabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-ali-12.md) | APPSEC\_ALI\_12 | LOW | | [Alibaba Cloud RDS Instance SQL Collector Retention Period is less than 180 misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-ali-25.md) | APPSEC\_ALI\_25 | LOW | | [Alibaba Cloud RDS instance does not have log\_duration enabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-ali-35.md) | APPSEC\_ALI\_35 | LOW | | [Alibaba Cloud RDS instance has log\_disconnections disabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-ali-36.md) | APPSEC\_ALI\_36 | LOW | | [Alibaba Cloud RDS log audit is disabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-ali-38.md) | APPSEC\_ALI\_38 | LOW | | [AWS CloudTrail log validation is not enabled in all regions misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-aws-36.md) | APPSEC\_AWS\_36 | LOW | | [AWS EKS control plane logging disabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-aws-37.md) | APPSEC\_AWS\_37 | LOW | | [Amazon MQ Broker logging is not enabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-aws-48.md) | APPSEC\_AWS\_48 | MEDIUM | | [AWS CloudWatch Log groups not configured with definite retention days misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-aws-66.md) | APPSEC\_AWS\_66 | LOW | | [AWS CloudTrail is not enabled with multi trail and not capturing all management events misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-aws-67.md) | APPSEC\_AWS\_67 | LOW | | [AWS Redshift database does not have audit logging enabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-aws-71.md) | APPSEC\_AWS\_71 | LOW | | [Global Accelerator does not have Flow logs enabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-aws-75.md) | APPSEC\_AWS\_75 | LOW | | [API Gateway does not have access logging enabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-aws-76.md) | APPSEC\_AWS\_76 | LOW | | [Amazon MSK cluster logging is not enabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-aws-80.md) | APPSEC\_AWS\_80 | MEDIUM | | [AWS Elasticsearch domain logging is not enabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-aws-84.md) | APPSEC\_AWS\_84 | MEDIUM | | [AWS DocumentDB logging is not enabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-aws-85.md) | APPSEC\_AWS\_85 | MEDIUM | | [AWS CloudFront distribution with access logging disabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-aws-86.md) | APPSEC\_AWS\_86 | LOW | | [AWS Elastic Load Balancer v2 (ELBv2) with access log disabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-aws-91.md) | APPSEC\_AWS\_91 | LOW | | [AWS Elastic Load Balancer (Classic) with access log disabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-aws-92.md) | APPSEC\_AWS\_92 | LOW | | [AWS API Gateway V2 has Access Logging is disabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-aws-95.md) | APPSEC\_AWS\_95 | LOW | | [Neptune logging is not enabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-aws-101.md) | APPSEC\_AWS\_101 | HIGH | | [AWS config is not enabled in all regions misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-aws-121.md) | APPSEC\_AWS\_121 | MEDIUM | | [AWS CloudWatch Log groups encrypted using default encryption key instead of KMS CMK misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-aws-158.md) | APPSEC\_AWS\_158 | LOW | | [AWS WAF Web Access Control Lists logging is disabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-aws-176.md) | APPSEC\_AWS\_176 | LOW | | [AWS AppSync's logging is disabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-aws-193.md) | APPSEC\_AWS\_193 | LOW | | [AWS AppSync has field-level logging disabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-aws-194.md) | APPSEC\_AWS\_194 | LOW | | [AWS MQBroker audit logging is disabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-aws-197.md) | APPSEC\_AWS\_197 | LOW | | [AWS ECS Cluster does not enable logging of ECS Exec misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-aws-223.md) | APPSEC\_AWS\_223 | LOW | | [AWS cluster logging is not enabled or client to container communication not encrypted using a Customer Managed Key (CMK) misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-aws-224.md) | APPSEC\_AWS\_224 | LOW | | [AWS ACM certificates does not have logging preference misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-aws-234.md) | APPSEC\_AWS\_234 | LOW | | [AWS MWAA environment has scheduler logs disabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-aws-242.md) | APPSEC\_AWS\_242 | LOW | | [AWS MWAA environment has worker logs disabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-aws-243.md) | APPSEC\_AWS\_243 | LOW | | [AWS MWAA environment has webserver logs disabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-aws-244.md) | APPSEC\_AWS\_244 | LOW | | [AWS CloudTrail logging is disabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-aws-251.md) | APPSEC\_AWS\_251 | LOW | | [AWS CloudTrail does not define an SNS Topic misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-aws-252.md) | APPSEC\_AWS\_252 | LOW | | [Data Trace is not enabled in the API Gateway Method Settings misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-aws-276.md) | APPSEC\_AWS\_276 | LOW | | [State machine does not have X-ray tracing enabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-aws-284.md) | APPSEC\_AWS\_284 | LOW | | [Execution history logging is not enabled on the State Machine misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-aws-285.md) | APPSEC\_AWS\_285 | MEDIUM | | [AWS CodeBuild project not configured with logging configuration misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-aws-314.md) | APPSEC\_AWS\_314 | LOW | | [Elasticsearch Domain Audit Logging is disabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-aws-317.md) | APPSEC\_AWS\_317 | MEDIUM | | [RDS Cluster log capture is disabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-aws-324.md) | APPSEC\_AWS\_324 | MEDIUM | | [RDS Cluster audit logging for MySQL engine is disabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-aws-325.md) | APPSEC\_AWS\_325 | LOW | | [AWS ECS services have automatic public IP address assignment enabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-aws-333.md) | APPSEC\_AWS\_333 | LOW | | [AWS CloudWatch log groups retention set to less than 365 days misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-aws-338.md) | APPSEC\_AWS\_338 | LOW | | [RDS instances have performance insights disabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-aws-353.md) | APPSEC\_AWS\_353 | LOW | | [Azure Network Watcher Network Security Group (NSG) flow logs retention is less than 90 days misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-azure-12.md) | APPSEC\_AZURE\_12 | LOW | | [Azure SQL Server auditing policy is disabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-azure-23.md) | APPSEC\_AZURE\_23 | LOW | | [Azure SQL Server audit log retention is not greater than 90 days misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-azure-24.md) | APPSEC\_AZURE\_24 | HIGH | | [Azure SQL server send alerts to field value is not set misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-azure-26.md) | APPSEC\_AZURE\_26 | HIGH | | [Azure storage account logging for queues is disabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-azure-33.md) | APPSEC\_AZURE\_33 | LOW | | [Azure Activity Log retention should not be set to less than 365 days misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-azure-37.md) | APPSEC\_AZURE\_37 | LOW | | [Azure Monitor log profile does not capture all activities misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-azure-38.md) | APPSEC\_AZURE\_38 | LOW | | [Azure App service HTTP logging is disabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-azure-63.md) | APPSEC\_AZURE\_63 | LOW | | [App service disables detailed error messages misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-azure-65.md) | APPSEC\_AZURE\_65 | LOW | | [App service does not enable failed request tracing misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-azure-66.md) | APPSEC\_AZURE\_66 | LOW | | [Server Parameter 'log\_retention' is Set to 'OFF' for PostgreSQL Database Server misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-azure-146.md) | APPSEC\_AZURE\_146 | LOW | | [Azure SQL Server does not have default auditing policy configured misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-azure-156.md) | APPSEC\_AZURE\_156 | LOW | | [Azure Built-in logging for Azure function app is disabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-azure-159.md) | APPSEC\_AZURE\_159 | LOW | | [Ledger feature is disabled on the database misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-azure-224.md) | APPSEC\_AZURE\_224 | MEDIUM | | [GCP Kubernetes Engine Clusters have Cloud Logging disabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-gcp-1.md) | APPSEC\_GCP\_1 | LOW | | [GCP VPC Flow logs for the subnet is set to Off misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-gcp-26.md) | APPSEC\_GCP\_26 | LOW | | [GCP PostgreSQL instance with log\_checkpoints database flag is disabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-gcp-51.md) | APPSEC\_GCP\_51 | LOW | | [GCP PostgreSQL instance database flag log\_connections is disabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-gcp-52.md) | APPSEC\_GCP\_52 | LOW | | [GCP PostgreSQL instance database flag log\_disconnections is disabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-gcp-53.md) | APPSEC\_GCP\_53 | LOW | | [GCP PostgreSQL instance database flag log\_lock\_waits is disabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-gcp-54.md) | APPSEC\_GCP\_54 | LOW | | [GCP PostgreSQL instance database flag log\_min\_messages is not set misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-gcp-55.md) | APPSEC\_GCP\_55 | LOW | | [GCP PostgreSQL instance database flag log\_temp\_files is not set to 0 misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-gcp-56.md) | APPSEC\_GCP\_56 | LOW | | [GCP PostgreSQL instance database flag log\_min\_duration\_statement is not set to -1 misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-gcp-57.md) | APPSEC\_GCP\_57 | LOW | | [GCP PostgreSQL instance database flag log\_hostname is not set to off misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-gcp-108.md) | APPSEC\_GCP\_108 | LOW | | [Log levels of the GCP PostgreSQL database are not set to ERROR or lower misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-gcp-109.md) | APPSEC\_GCP\_109 | LOW | | [pgAudit is disabled for your GCP PostgreSQL database misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-gcp-110.md) | APPSEC\_GCP\_110 | LOW | | [SQL statements of GCP PostgreSQL are not logged misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-gcp-111.md) | APPSEC\_GCP\_111 | MEDIUM | | [The --audit-log-path argument is not set misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-k8s-91.md) | APPSEC\_K8S\_91 | MEDIUM | | [The --audit-log-maxage argument is not set appropriately misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-k8s-92.md) | APPSEC\_K8S\_92 | LOW | | [The --audit-log-maxbackup argument is not set appropriately misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-k8s-93.md) | APPSEC\_K8S\_93 | LOW | | [The --audit-log-maxsize argument is not set appropriately misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-k8s-94.md) | APPSEC\_K8S\_94 | LOW | | [Security policies missing descriptions in Palo Alto Networks devices misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-pan-8.md) | APPSEC\_PAN\_8 | LOW | | [Log Forwarding Profile not selected for a Palo Alto Networks device security policy rule misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-pan-9.md) | APPSEC\_PAN\_9 | LOW | | [End-of-session logging disabled on Palo Alto Networks security policies misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-pan-10.md) | APPSEC\_PAN\_10 | LOW | | [Logging at session start enabled on Palo Alto Networks devices misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec-pan-16.md) | APPSEC\_PAN\_16 | LOW | | [API Gateway stage does not have logging level defined appropriately misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec2-aws-4.md) | APPSEC2\_AWS\_4 | LOW | | [AWS CloudTrail trail logs is not integrated with CloudWatch Log misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec2-aws-10.md) | APPSEC2\_AWS\_10 | LOW | | [AWS VPC Flow Logs not enabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec2-aws-11.md) | APPSEC2\_AWS\_11 | LOW | | [AWS RDS Postgres Cluster does not have query logging enabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec2-aws-27.md) | APPSEC2\_AWS\_27 | LOW | | [AWS Postgres RDS have Query Logging disabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec2-aws-30.md) | APPSEC2\_AWS\_30 | LOW | | [AWS WAF2 does not have a Logging Configuration misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec2-aws-31.md) | APPSEC2\_AWS\_31 | LOW | | [AWS Codecommit is not associated with an approval rule misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec2-aws-37.md) | APPSEC2\_AWS\_37 | LOW | | [Domain Name System (DNS) query logging is not enabled for Amazon Route 53 hosted zones misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec2-aws-39.md) | APPSEC2\_AWS\_39 | LOW | | [AWS Config Recording is disabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec2-aws-45.md) | APPSEC2\_AWS\_45 | LOW | | [AWS Config must record all possible resources misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec2-aws-48.md) | APPSEC2\_AWS\_48 | LOW | | [An S3 bucket must have a lifecycle configuration misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec2-aws-61.md) | APPSEC2\_AWS\_61 | MEDIUM | | [S3 buckets do not have event notifications enabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec2-aws-62.md) | APPSEC2\_AWS\_62 | LOW | | [AWS Network Firewall is not configured with logging configuration misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec2-aws-63.md) | APPSEC2\_AWS\_63 | LOW | | [Azure storage account logging setting for tables is disabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec2-azure-20.md) | APPSEC2\_AZURE\_20 | LOW | | [Azure storage account logging setting for blobs is disabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec2-azure-21.md) | APPSEC2\_AZURE\_21 | LOW | | [GCP Log bucket retention policy is not configured using bucket lock misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec2-gcp-4.md) | APPSEC2\_GCP\_4 | LOW | | [GCP Project audit logging is not configured properly across all services and all users in a project misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec2-gcp-5.md) | APPSEC2\_GCP\_5 | LOW | | [GCP PostgreSQL instance database flag log\_duration is not set to on misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec2-gcp-13.md) | APPSEC2\_GCP\_13 | LOW | | [GCP PostgreSQL instance database flag log\_executor\_stats is not set to off misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec2-gcp-14.md) | APPSEC2\_GCP\_14 | LOW | | [GCP PostgreSQL instance database flag log\_parser\_stats is not set to off misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec2-gcp-15.md) | APPSEC2\_GCP\_15 | LOW | | [GCP PostgreSQL instance database flag log\_planner\_stats is not set to off misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec2-gcp-16.md) | APPSEC2\_GCP\_16 | LOW | | [GCP PostgreSQL instance database flag log\_statement\_stats is not set to off misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec2-gcp-17.md) | APPSEC2\_GCP\_17 | LOW | | [Logging is disabled for Dialogflow agents misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec2-gcp-29.md) | APPSEC2\_GCP\_29 | MEDIUM | | [Logging for Dialogflow CX agents is disabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec2-gcp-30.md) | APPSEC2\_GCP\_30 | MEDIUM | | [Logging for Dialogflow CX webhooks is disabled misconfiguration detected in code](/appsec-rules/iac-security/logging/appsec2-gcp-31.md) | APPSEC2\_GCP\_31 | MEDIUM | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.