AWS Redshift database does not have audit logging enabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_71
Category - Subcategory	Logging - Disabled or missing
Provider	AWS
Severity	LOW
Framework	CloudFormation, Serverless, Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	91c941aa-d110-4b33-9934-aadd86b1a4d9

Impact

Amazon Redshift logs information about connections and user activities in your database. These logs help you to monitor the database for security and troubleshooting purposes, a process often referred to as database auditing. The logs are stored in Amazon S3 buckets. These provide convenient access with data security features for users who are responsible for monitoring activities in the database. Enabling S3 bucket logging on Redshift databases allows you to capture all events which may affect the database, this is useful in security and incident response workflows.

How to Fix

Resource: AWS::Redshift::Cluster

• Arguments: Properties.BucketName [source,go]

---

Type: "AWS::Redshift::Cluster" Properties: ...

• LoggingProperties:
• BucketName: "your_bucket"

---