AWS DocumentDB logging is not enabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_85
Category - Subcategory	Logging - Disabled or missing
Provider	AWS
Severity	MEDIUM
Framework	CloudFormation, Serverless, Terraform, Terraform Plan

Impact

This rule ensures that Amazon DocumentDB (DocDB) clusters have logging enabled. Enabling logging helps you monitor and troubleshoot your DocDB clusters by providing visibility into database activity and operations. This rule checks whether the EnableCloudwatchLogsExports property includes the required log types (profiler and/or audit).

How to Fix

To fix this issue, ensure that the EnableCloudwatchLogsExports property in the AWS::DocDB::DBCluster resource includes one or both of the required log types (profiler and/or audit).

Example: [source,go]

Resources: MyDocDBCluster: Type: AWS::DocDB::DBCluster Properties: DBClusterIdentifier: example-cluster EnableCloudwatchLogsExports:

• profiler
• audit ...

---