Skip to main content

🛡️ AWS MQ ActiveMQ Broker Audit Logging is not enabled🟢

Logic​

Similar Policies​

Description​

Open File

Description​

This policy identifies AWS MQ for ActiveMQ Brokers that do not have audit logging enabled.

Rationale​

Audit logging provides visibility into administrative actions performed on the broker, including changes made through the Amazon MQ console, AWS CLI, or Amazon MQ API. Enabling audit logs is a security best practice that helps detect unauthorized or unexpected configuration changes and supports compliance and governance requirements by maintaining a detailed audit trail of management activity.

Audit​

This policy flags an AWS MQ Broker running ActiveMQ as INCOMPLIANT when the Logs: Audit field is set to Disabled.

AWS MQ Brokers running RabbitMQ are marked as INAPPLICABLE.

Remediation​

Open File

Remediation​

Enable Audit Logging for the Broker​

Enable audit logging on the Amazon MQ for ActiveMQ broker to ensure that all administrative actions are captured and delivered to Amazon CloudWatch Logs.

From the Command Line​
Step 1: Enable Audit Logs on the Broker​

Run the following command to update the broker configuration and enable audit logging:

aws mq update-broker \
  --broker-id {{broker-id}} \
  --logs 'Audit=true'

Ensure Required CloudWatch Logs Permissions​

Audit logs are delivered to Amazon CloudWatch Logs. To successfully publish logs, the required IAM permissions and resource-based policies must be in place.

Grant logs:CreateLogGroup Permission​

Ensure that the IAM principal used to create or manage the broker has permission to create CloudWatch log groups.

Example IAM policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "logs:CreateLogGroup",
      "Resource": "arn:aws:logs:*:*:log-group:/aws/amazonmq/*"
    }
  ]
}

Important: If this permission is not granted before the broker is created or rebooted, Amazon MQ will not create the required log group.

... see more

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [MQ.2] ActiveMQ brokers should stream audit logs to CloudWatch1no data
💼 Cloudaware Framework → 💼 Logging and Monitoring Configuration72no data
💼 FedRAMP High Security Controls → 💼 AU-2 Event Logging (L)(M)(H)23no data
💼 FedRAMP High Security Controls → 💼 AU-3 Content of Audit Records (L)(M)(H)134no data
💼 FedRAMP High Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)270no data
💼 FedRAMP High Security Controls → 💼 SI-4 System Monitoring (L)(M)(H)145059no data
💼 FedRAMP Low Security Controls → 💼 AU-2 Event Logging (L)(M)(H)23no data
💼 FedRAMP Low Security Controls → 💼 AU-3 Content of Audit Records (L)(M)(H)20no data
💼 FedRAMP Low Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)70no data
💼 FedRAMP Low Security Controls → 💼 SI-4 System Monitoring (L)(M)(H)10no data
💼 FedRAMP Moderate Security Controls → 💼 AU-2 Event Logging (L)(M)(H)23no data
💼 FedRAMP Moderate Security Controls → 💼 AU-3 Content of Audit Records (L)(M)(H)134no data
💼 FedRAMP Moderate Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)70no data
💼 FedRAMP Moderate Security Controls → 💼 SI-4 System Monitoring (L)(M)(H)712no data
💼 NIST CSF v2.0 → 💼 DE.AE-02: Potentially adverse events are analyzed to better understand associated activities45no data
💼 NIST CSF v2.0 → 💼 DE.AE-03: Information is correlated from multiple sources60no data
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events167no data
💼 NIST CSF v2.0 → 💼 DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events95no data
💼 NIST CSF v2.0 → 💼 DE.CM-06: External service provider activities and services are monitored to find potentially adverse events45no data
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events168no data
💼 NIST CSF v2.0 → 💼 ID.IM-01: Improvements are identified from evaluations37no data
💼 NIST CSF v2.0 → 💼 ID.IM-02: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties51no data
💼 NIST CSF v2.0 → 💼 ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities52no data
💼 NIST CSF v2.0 → 💼 ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded41no data
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected178no data
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected154no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected174no data
💼 NIST SP 800-53 Revision 5 → 💼 AU-2 Event Logging423no data
💼 NIST SP 800-53 Revision 5 → 💼 AU-3 Content of Audit Records31334no data
💼 NIST SP 800-53 Revision 5 → 💼 AU-12 Audit Record Generation44770no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-4 System Monitoring25114no data
💼 PCI DSS v3.2.1 → 💼 10.5.3 Promptly back up audit trail files to a centralized log server or media that is difficult to alter.1no data
💼 PCI DSS v3.2.1 → 💼 10.5.4 Write logs for external-facing technologies onto a secure, centralized, internal log server or media device.1no data
💼 PCI DSS v4.0.1 → 💼 10.3.3 Audit log files, including those for external-facing technologies, are promptly backed up to a secure, central, internal log server(s) or other media that is difficult to modify.1no data
💼 PCI DSS v4.0 → 💼 10.3.3 Audit log files, including those for external-facing technologies, are promptly backed up to a secure, central, internal log server(s) or other media that is difficult to modify.1no data