# Ensure Audit Logging is Enabled

- Source: https://support.icompaas.com/support/solutions/articles/62000234488-ensure-audit-logging-is-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS AWS Database Services Benchmark v1.0.0](https://support.icompaas.com/support/solutions/62000112688) › [CIS AWS Database Services Benchmark v1.0.0](https://support.icompaas.com/support/solutions/folders/62000169253)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Profile Applicability • Level 1

Description  
 Enable audit logging to capture database activities, including login attempts, queries, and modifications. Logs should be forwarded to Amazon CloudWatch or a centralized log management system for analysis and monitoring.

Rationale  
 Audit logging ensures traceability of activities, enabling monitoring for suspicious behavior and providing a forensic trail in case of security incidents.

Impact  
 Pros:  
 • Improves visibility into database usage  
 • Supports compliance and security monitoring

Cons:  
 • May increase storage costs  
 • Requires log review processes

Default Value  
 Audit logging is not enabled by default on all services. You must manually configure it based on the database engine in use.

Pre-Requisites  
 • An Amazon CloudWatch Logs group or an Amazon S3 bucket for log storage  
 • IAM permissions to modify database configurations

### Remediation

#### Test Plan

1.  Sign in to the AWS Console  
      
    
2.  Open the database console (e.g., DocumentDB, Neptune, MemoryDB, etc.)  
      
    
3.  Navigate to the cluster's configuration or logging settings  
      
    
4.  Verify that audit logging is enabled and directed to CloudWatch or S3  
      
    
5.  Confirm retention period and access policies are in place  
      
    

### Implementation Plan

#### Using AWS Console

1.  Sign in to the [AWS Management Console](https://console.aws.amazon.com/)
    
2.  Open the database console (e.g., DocumentDB, Neptune, MemoryDB)  
      
    
3.  Select your database cluster  
      
    
4.  Navigate to Logging or Monitoring section
    
5.  Click Modify or Edit  
      
    
6.  Enable Audit Logging  
      
    
7.  Choose a CloudWatch Logs group or S3 bucket  
      
    
8.  Set retention policy  
      
    
9.  Click Save or Apply Changes  
      
    

#### Using AWS CLI

1.  Identify your cluster name:  
    
     aws docdb describe-db-clusters
    
      
    
2.  Enable audit logs (DocumentDB example): 
    
    aws docdb modify-db-cluster --db-cluster-identifier my-cluster --cloudwatch-logs-export-configuration '{"EnableLogTypes":\["audit"\]}' --apply-immediately
    
      
    
3.  Verify logs are enabled:  
    
     aws docdb describe-db-clusters --db-cluster-identifier my-cluster
    
      
    

### Backout Plan

#### Using AWS Console

1.  Sign in to the AWS Console  
      
    
2.  Open the database service  
      
    
3.  Select your cluster  
      
    
4.  Navigate to Logging section  
      
    
5.  Click Edit or Modify  
      
    
6.  Disable audit logging  
      
    
7.  Click Save  
      
    

#### Using AWS CLI

1.  Run the following to disable audit logs:  
    
     aws docdb modify-db-cluster --db-cluster-identifier my-cluster --cloudwatch-logs-export-configuration '{"DisableLogTypes":\["audit"\]}' --apply-immediately
    
      
    

References  
 • [Amazon DocumentDB Audit Logging](https://docs.aws.amazon.com/documentdb/latest/developerguide/event-auditing.html) • [Amazon CloudWatch Logs](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/WhatIsCloudWatchLogs.html)

CIS Controls Mapping  
 • v8 - 8.1 Establish and Maintain an Audit Log Management Process  
 • v7 - 6.2 Activate audit loggingCIS\_AWS\_Database\_Servic…

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.