Skip to main content

📝 AWS Data Sync Task logging is not enabled 🟢

  • Contextual name: 📝 Task logging is not enabled 🟢
  • ID: /ce/ca/aws/data-sync/task-logging
  • Located in: 📁 AWS Data Sync

Flags​

Our Metadata​

  • Policy Type: COMPLIANCE_POLICY
  • Policy Category:
    • SECURITY

Similar Policies​

Logic​

Description​

Open File

Description​

Ensure that AWS DataSync Tasks are configured to send transfer logs to Amazon CloudWatch Logs.

Rationale​

Enabling logging for DataSync Tasks provides visibility into data transfer operations.

Impact​

Enabling logging will may incur charges for Amazon CloudWatch Logs based on the amount of data ingested and stored.

Audit​

This policy marks an AWS Data Sync Task as INCOMPLIANT if the Cloud Watch Log Group ARN field is empty or the associated Cloud Watch Log Group does not exist in the CMDB.

Remediation​

Open File

Remediation​

From Command Line​

Prerequisites​

If you need to create a new CloudWatch Log Group, use the following command:

aws logs create-log-group --log-group-name {{log-group-name}}

Ensure that DataSync has permission to upload logs to the CloudWatch log group.

Associate the Log Group with the DataSync Task​
aws datasync update-task \
    --task-arn {{task-arn}} \
    --cloud-watch-log-group-arn {{log-group-arn}}

Note: For Enhanced mode tasks, you must use /aws/datasync as your log group name. For example: arn:aws:logs:us-east-1:111222333444:log-group:/aws/datasync:*

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlags
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [DataSync.1] DataSync tasks should have logging enabled1
💼 Cloudaware Framework → 💼 Logging and Monitoring Configuration59