Skip to content

enable-log-export

Explanation

Neptune does not have auditing by default. To ensure that you are able to accurately audit the usage of your Neptune instance you should enable export logs.

Possible Impact

Limited visibility of audit trail for changes to Neptune

Suggested Resolution

Enable export logs

Insecure Example

The following example will fail the AVD-AWS-0075 check.

---
AWSTemplateFormatVersion: 2010-09-09
Description: Bad example
Resources:
  Cluster:
    Type: AWS::Neptune::DBCluster
    Properties:
      EnableCloudwatchLogsExports:
        - debug

Secure Example

The following example will pass the AVD-AWS-0075 check.

---
AWSTemplateFormatVersion: 2010-09-09
Description: Bad example
Resources:
  Cluster:
    Type: AWS::Neptune::DBCluster
    Properties:
      EnableCloudwatchLogsExports:
        - audit