AWS MWAA environment has worker logs disabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_243
Category - Subcategory	Logging - Disabled or missing
Provider	AWS
Severity	LOW
Framework	Terraform

Impact

It is recommended to have a proper logging process for AWS MWAA environment worker in order to track configuration changes conducted manually and programmatically and trace back unapproved changes.

How to Fix

[source,go]

resource "aws_mwaa_environment" "pass" { dag_s3_path = "dags/" execution_role_arn = "aws_iam_role.example.arn"

logging_configuration { worker_logs { enabled = true log_level = "CRITICAL" } }

name = "example"

network_configuration { security_group_ids = ["aws_security_group.example.id"] subnet_ids = "aws_subnet.private[*].id" }

source_bucket_arn = "aws_s3_bucket.example.arn" }