# Ensure RDS instances are integrated with CloudWatch Logs

- Source: https://support.icompaas.com/support/solutions/articles/a_1793292218905145-ensure-rds-instances-are-integrated-with-cloudwatch-logs
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224)
- Last updated: 2026-10-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that every Amazon RDS DB instance publishes at least one of its database logs to Amazon CloudWatch Logs. Depending on the engine, the available log types include the error, general, slow query and audit logs (MySQL and MariaDB), the PostgreSQL log, the alert, audit, listener and trace logs (Oracle) and the agent and error logs (SQL Server).

**Rationale**

When database logs stay only on the DB instance, they are hard to search, are kept for a limited time and cannot be used for alerts. This hides failed logins, credential misuse, SQL injection attempts, data exfiltration and privilege abuse, and slows down troubleshooting of errors and slow queries. Exporting the logs to CloudWatch Logs centralizes them, allows retention to be set, and makes it possible to create metric filters and alarms or to forward the logs to a SIEM.

**Impact**

-   Centralizes database logs for monitoring, alerting and investigations
    
-   Allows log retention to be controlled independently of the DB instance
    
-   CloudWatch Logs ingestion and storage are charged, which can be significant for verbose logs such as the general log
    
-   Some log types, such as the MySQL general and slow query logs, also need to be turned on in the DB parameter group before they produce data
    

**Default Value**

Log export to CloudWatch Logs is disabled by default. No log types are published until they are selected.

**Pre-Requisites**

-   IAM permissions: rds:DescribeDBInstances and rds:ModifyDBInstance
    
-   A decision on which log types to export for each engine
    
-   For MySQL and MariaDB general and slow query logs, a custom DB parameter group with general\_log or slow\_query\_log set to 1 and log\_output set to FILE
    

**Remediation**

**Test Plan**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon RDS console and select **Databases**.
    
3.  Select a DB instance and open the **Configuration** tab.
    
4.  Check which log types are published to CloudWatch Logs.
    
5.  Repeat for each DB instance in each region in use.
    
6.  If no log type is published, follow the implementation steps.
    

**CLI:**

Show the log types exported to CloudWatch Logs for all DB instances:

aws rds describe-db-instances --region <REGION> --query "DBInstances\[\].\[DBInstanceIdentifier,Engine,EnabledCloudwatchLogsExports\]"

A DB instance fails if EnabledCloudwatchLogsExports is null or empty, meaning no log type is exported.

**Implementation Steps**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon RDS console and select **Databases**.
    
3.  Select the DB instance found in the Test Plan and choose **Modify**.
    
4.  In the **Log exports** section, select the log types to publish to CloudWatch Logs (for example **Error log** or **PostgreSQL log**).
    
5.  Choose **Continue**, then **Modify DB instance**.
    
6.  Repeat for each affected DB instance in each region in use.
    

**CLI:**

Enable export of a log type (for example error, audit, postgresql or alert, depending on the engine):

aws rds modify-db-instance --region <REGION> --db-instance-identifier <DB\_INSTANCE\_ID> --cloudwatch-logs-export-configuration '{"EnableLogTypes":\["<LOG\_TYPE>"\]}'

Changes to log exports are applied immediately and do not require a reboot.

**Backout Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon RDS console, select the DB instance and choose **Modify**.
    
3.  In the **Log exports** section, clear the log types that were added.
    
4.  Choose **Continue**, then **Modify DB instance**.
    

**CLI:**

aws rds modify-db-instance --region <REGION> --db-instance-identifier <DB\_INSTANCE\_ID> --cloudwatch-logs-export-configuration '{"DisableLogTypes":\["<LOG\_TYPE>"\]}'

Note: disabling log export removes central visibility of database activity. Logs already in CloudWatch Logs are kept according to the log group retention setting.

**Reference**

-   [https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/publishing\_cloudwatchlogs.html](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/publishing_cloudwatchlogs.html)
    
-   [https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER\_LogAccess.html](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_LogAccess.html)
    
-   [https://docs.aws.amazon.com/cli/latest/reference/rds/modify-db-instance.html](https://docs.aws.amazon.com/cli/latest/reference/rds/modify-db-instance.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.