AWS MQBroker audit logging is disabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_197
Category - Subcategory	Logging - Disabled or missing
Provider	AWS
Severity	LOW
Framework	CloudFormation, Terraform, Terraform Plan

Impact

This rule ensures that Amazon MQ Brokers have audit logging enabled. Audit logging is crucial for tracking access and changes to your MQ Brokers, thereby providing visibility into security-relevant events and supporting compliance requirements. This rule checks whether the logs property is configured to enable audit logging. Note that audit logging is not supported for RabbitMQ engine types.

How to Fix

To fix this issue, ensure that the Audit property in the Logs configuration of the AWS::AmazonMQ::Broker resource is set to true, unless the engine type is RabbitMQ.

Example: [source,go]

Resources: MyMQBroker: Type: AWS::AmazonMQ::Broker Properties: ... Logs: Audit: true ...