---
names:
  full: "AWS RDS Cluster database logging is not enabled"
  contextual: "Cluster database logging is not enabled"
description: >
  Ensure that RDS DB clusters are configured to export database logs to CloudWatch Logs. 
  Enabling logging provides visibility into database activity, performance issues, 
  and security events, which is critical for auditing and incident response.
type: "COMPLIANCE_POLICY"
categories:
  - "RELIABILITY"
frameworkMappings:
  - "/frameworks/cloudaware/logging-and-monitoring/logging-and-monitoring-configuration"
  - "/frameworks/aws-fsbp-v1.0.0/rds/34"
  - "/frameworks/aws-fsbp-v1.0.0/rds/37"
  - "/frameworks/aws-fsbp-v1.0.0/documentdb/04"
  - "/frameworks/aws-fsbp-v1.0.0/neptune/02"
similarPolicies:
  awsSecurityHub:
    - name: "[RDS.34] Aurora MySQL DB clusters should publish audit logs to CloudWatch Logs"
      url: "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-34"
    - name: "[RDS.37] Aurora PostgreSQL DB clusters should publish logs to CloudWatch Logs"
      url: "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-37"
    - name: "[DocumentDB.4] Amazon DocumentDB clusters should publish audit logs to CloudWatch Logs"
      url: "https://docs.aws.amazon.com/securityhub/latest/userguide/documentdb-controls.html#documentdb-4"
    - name: "[Neptune.2] Neptune DB clusters should publish audit logs to CloudWatch Logs"
      url: "https://docs.aws.amazon.com/securityhub/latest/userguide/neptune-controls.html#neptune-2"
