enable-log-export
Explanation
Neptune does not have auditing by default. To ensure that you are able to accurately audit the usage of your Neptune instance you should enable export logs.
Possible Impact
Limited visibility of audit trail for changes to Neptune
Suggested Resolution
Enable export logs
Insecure Example
The following example will fail the AVD-AWS-0075 check.
---
AWSTemplateFormatVersion: 2010-09-09
Description: Bad example
Resources:
Cluster:
Type: AWS::Neptune::DBCluster
Properties:
EnableCloudwatchLogsExports:
- debug
Secure Example
The following example will pass the AVD-AWS-0075 check.
---
AWSTemplateFormatVersion: 2010-09-09
Description: Bad example
Resources:
Cluster:
Type: AWS::Neptune::DBCluster
Properties:
EnableCloudwatchLogsExports:
- audit