# Ensure Redshift cluster has audit logging enabled - Source: https://support.icompaas.com/support/solutions/articles/a_1793292220913569-ensure-redshift-cluster-has-audit-logging-enabled - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224) - Last updated: 2026-10-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Description** Ensure that every Amazon Redshift provisioned cluster has database audit logging enabled. Audit logging records connection attempts, changes to database users and, optionally, the queries run on the database, and delivers these logs to an Amazon S3 bucket or to Amazon CloudWatch Logs. **Rationale** Without audit logs, malicious logins, unauthorized user or permission changes and suspicious queries can go unnoticed. There is also no evidence available for forensic analysis and incident response. Enabling audit logging, storing the logs in a protected destination with controlled access and retention, and alerting on unusual connections or queries improves detection and supports investigations. **Impact** - Provides a record of connections, user changes and database activity for security monitoring and investigations - Helps meet audit and compliance requirements - S3 storage or CloudWatch Logs ingestion and storage are charged - Logging the queries run on the database (user activity log) also requires the enable\_user\_activity\_logging parameter to be set to true in the cluster parameter group **Default Value** Audit logging is disabled by default for Amazon Redshift provisioned clusters. **Pre-Requisites** - IAM permissions: redshift:DescribeClusters, redshift:DescribeLoggingStatus, redshift:EnableLogging and redshift:DisableLogging - When logging to Amazon S3: a bucket in the same region as the cluster, using Amazon S3 managed encryption (SSE-S3), with a bucket policy that allows Amazon Redshift to write to it - When logging to CloudWatch Logs: no extra setup is needed; Redshift creates the log groups automatically **Remediation** **Test Plan** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon Redshift console and select **Clusters**. 3. Select a cluster and open the **Properties** tab. 4. Check that audit logging is shown as enabled, with an S3 bucket or CloudWatch as the destination. 5. Repeat for each cluster in each region in use. 6. If audit logging is disabled, follow the implementation steps. **CLI:** List the clusters: aws redshift describe-clusters --region --query "Clusters\[\].ClusterIdentifier" Show the audit logging status of a cluster: aws redshift describe-logging-status --region --cluster-identifier --query "\[LoggingEnabled,LogDestinationType,BucketName,LogExports\]" A cluster fails if LoggingEnabled is false. **Implementation Steps** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon Redshift console and select **Clusters**. 3. Select the cluster found in the Test Plan and open the **Properties** tab. 4. Open the audit logging settings for editing. 5. Turn on audit logging and choose the destination: - **CloudWatch**: select the log types to export (connection log, user log, user activity log), or - **S3 bucket**: select an existing bucket and optionally enter a prefix. 6. Choose **Save changes**. 7. Repeat for each affected cluster in each region in use. **CLI:** Enable audit logging to an S3 bucket: aws redshift enable-logging --region --cluster-identifier --bucket-name Or enable audit logging to CloudWatch Logs: aws redshift enable-logging --region --cluster-identifier --log-destination-type cloudwatch --log-exports connectionlog userlog useractivitylog **Backout Plan** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon Redshift console and select the cluster. 3. In the **Properties** tab, open the audit logging settings for editing. 4. Turn off audit logging and choose **Save changes**. **CLI:** aws redshift disable-logging --region --cluster-identifier Note: disabling audit logging removes visibility of database connections and activity. Logs already delivered are kept in the S3 bucket or CloudWatch Logs. **Reference** - [https://docs.aws.amazon.com/redshift/latest/mgmt/db-auditing.html](https://docs.aws.amazon.com/redshift/latest/mgmt/db-auditing.html) - [https://docs.aws.amazon.com/redshift/latest/mgmt/db-auditing-console.html](https://docs.aws.amazon.com/redshift/latest/mgmt/db-auditing-console.html) - [https://docs.aws.amazon.com/cli/latest/reference/redshift/enable-logging.html](https://docs.aws.amazon.com/cli/latest/reference/redshift/enable-logging.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.