🧠 AWS RDS Cluster required log exports to CloudWatch Logs are not enabled - prod.logic.yaml🟢

Contextual name: 🧠 prod.logic.yaml🟢
ID: /ce/ca/aws/rds/cluster-cloudwatch-logs-export/prod.logic.yaml
Tags:
- 🟢 Logic test success
- 🟢 Logic with extracts
- 🟢 Logic with test data

Uses

📗 AWS RDS Cluster
🔌 AWS RDS Cluster - object.extracts.yaml
🧪 test-data.json

Test Results 🟢

Generated at: 2026-06-06T12:03:12.037248868Z Open

Result	Id	Condition Index	Condition Text	Runtime Error
🟢	test1	✔️ `99`	✔️ `isDisappeared(CA10__disappearanceTime__c)`	✔️ `null`
🟢	test2	✔️ `199`	✔️ `extract('CA10__status__c') != 'available'`	✔️ `null`
🟢	test3	✔️ `299`	✔️ `extract('CA10__engine__c') != 'aurora-mysql' && extract('CA10__engine__c') != 'aurora-postgresql' && extract('CA10__engine__c') != 'docdb' && extract('CA10__engine__c') != 'neptune'`	✔️ `null`
🟢	test4	✔️ `399`	✔️ `extract('CA10__engine__c') == 'aurora-mysql' && not(extract('CA10__enabledCloudwatchLogsExports__c').contains('audit'))`	✔️ `null`
🟢	test5	✔️ `499`	✔️ `extract('CA10__engine__c') == 'aurora-mysql' && extract('CA10__enabledCloudwatchLogsExports__c').contains('audit')`	✔️ `null`
🟢	test6	✔️ `599`	✔️ `extract('CA10__engine__c') == 'aurora-postgresql' && not(extract('CA10__enabledCloudwatchLogsExports__c').contains('postgresql'))`	✔️ `null`
🟢	test7	✔️ `699`	✔️ `extract('CA10__engine__c') == 'aurora-postgresql' && extract('CA10__enabledCloudwatchLogsExports__c').contains('postgresql')`	✔️ `null`
🟢	test8	✔️ `799`	✔️ `extract('CA10__engine__c') == 'docdb' && not(extract('CA10__enabledCloudwatchLogsExports__c').contains('audit'))`	✔️ `null`
🟢	test9	✔️ `899`	✔️ `extract('CA10__engine__c') == 'docdb' && extract('CA10__enabledCloudwatchLogsExports__c').contains('audit')`	✔️ `null`
🟢	test10	✔️ `999`	✔️ `extract('CA10__engine__c') == 'neptune' && not(extract('CA10__enabledCloudwatchLogsExports__c').contains('audit'))`	✔️ `null`
🟢	test11	✔️ `1099`	✔️ `extract('CA10__engine__c') == 'neptune' && extract('CA10__enabledCloudwatchLogsExports__c').contains('audit')`	✔️ `null`

Generation Bundle

	File	MD5
Open	`/ce/ca/aws/rds/cluster-cloudwatch-logs-export/policy.yaml`	`316863A8CA5CABA268EF48C4ACCBF9AE`
Open	`/ce/ca/aws/rds/cluster-cloudwatch-logs-export/prod.logic.yaml`	`4D5295E6DA92C95298E8FB243BE762C1`
Open	`/ce/ca/aws/rds/cluster-cloudwatch-logs-export/test-data.json`	`F29015E866309FA150749D85A6D666B8`
Open	`/types/CA10__CaAwsDbCluster__c/object.extracts.yaml`	`8AACD486F39325BBBA7FE4FA3BE340E9`

Available Commands

repo-manager policies generate FULL /ce/ca/aws/rds/cluster-cloudwatch-logs-export/prod.logic.yaml
repo-manager policies generate DEBUG /ce/ca/aws/rds/cluster-cloudwatch-logs-export/prod.logic.yaml
repo-manager policies generate CAPTURE_TEST_DATA /ce/ca/aws/rds/cluster-cloudwatch-logs-export/prod.logic.yaml
repo-manager policies generate TESTS /ce/ca/aws/rds/cluster-cloudwatch-logs-export/prod.logic.yaml
# Execute tests
repo-manager policies test /ce/ca/aws/rds/cluster-cloudwatch-logs-export/prod.logic.yaml

Content

Open File

---
inputType: "CA10__CaAwsDbCluster__c"
testData:
  - file: "test-data.json"
importExtracts:
  - file: "/types/CA10__CaAwsDbCluster__c/object.extracts.yaml"
conditions:
  - status: "INAPPLICABLE"
    currentStateMessage: "The cluster is not available."
    check:
      NOT_EQUAL:
        left:
          EXTRACT: "CA10__status__c"
        right:
          TEXT: "available"
  - status: "INAPPLICABLE"
    currentStateMessage: "This policy applies only to Aurora MySQL, Aurora PostgreSQL, Amazon DocumentDB, and Amazon Neptune clusters."
    check:
      AND:
        args:
          - NOT_EQUAL:
              left:
                EXTRACT: "CA10__engine__c"
              right:
                TEXT: "aurora-mysql"
          - NOT_EQUAL:
              left:
                EXTRACT: "CA10__engine__c"
              right:
                TEXT: "aurora-postgresql"
          - NOT_EQUAL:
              left:
                EXTRACT: "CA10__engine__c"
              right:
                TEXT: "docdb"
          - NOT_EQUAL:
              left:
                EXTRACT: "CA10__engine__c"
              right:
                TEXT: "neptune"
  - status: "INCOMPLIANT"
    currentStateMessage: "Aurora MySQL audit logs are not exported to CloudWatch Logs."
    remediationMessage: "Enable export of audit logs to CloudWatch Logs for the Aurora MySQL cluster."
    check:
      AND:
        args:
          - IS_EQUAL:
              left:
                EXTRACT: "CA10__engine__c"
              right:
                TEXT: "aurora-mysql"
          - NOT:
              arg:
                CONTAINS:
                  arg:
                    EXTRACT: "CA10__enabledCloudwatchLogsExports__c"
                  search:
                    TEXT: "audit"
  - status: "COMPLIANT"
    currentStateMessage: "Aurora MySQL audit logs are exported to CloudWatch Logs."
    check:
      AND:
        args:
          - IS_EQUAL:
              left:
                EXTRACT: "CA10__engine__c"
              right:
                TEXT: "aurora-mysql"
          - CONTAINS:
              arg:
                EXTRACT: "CA10__enabledCloudwatchLogsExports__c"
              search:
                TEXT: "audit"
  - status: "INCOMPLIANT"
    currentStateMessage: "Aurora PostgreSQL logs are not exported to CloudWatch Logs."
    remediationMessage: "Enable export of PostgreSQL logs to CloudWatch Logs for the Aurora PostgreSQL cluster."
    check:
      AND:
        args:
          - IS_EQUAL:
              left:
                EXTRACT: "CA10__engine__c"
              right:
                TEXT: "aurora-postgresql"
          - NOT:
              arg:
                CONTAINS:
                  arg:
                    EXTRACT: "CA10__enabledCloudwatchLogsExports__c"
                  search:
                    TEXT: "postgresql"
  - status: "COMPLIANT"
    currentStateMessage: "Aurora PostgreSQL logs are exported to CloudWatch Logs."
    check:
      AND:
        args:
          - IS_EQUAL:
              left:
                EXTRACT: "CA10__engine__c"
              right:
                TEXT: "aurora-postgresql"
          - CONTAINS:
              arg:
                EXTRACT: "CA10__enabledCloudwatchLogsExports__c"
              search:
                TEXT: "postgresql"
  - status: "INCOMPLIANT"
    currentStateMessage: "DocumentDB audit logs are not exported to CloudWatch Logs."
    remediationMessage: "Enable export of audit logs to CloudWatch Logs for the Amazon DocumentDB cluster."
    check:
      AND:
        args:
          - IS_EQUAL:
              left:
                EXTRACT: "CA10__engine__c"
              right:
                TEXT: "docdb"
          - NOT:
              arg:
                CONTAINS:
                  arg:
                    EXTRACT: "CA10__enabledCloudwatchLogsExports__c"
                  search:
                    TEXT: "audit"
  - status: "COMPLIANT"
    currentStateMessage: "DocumentDB audit logs are exported to CloudWatch Logs."
    check:
      AND:
        args:
          - IS_EQUAL:
              left:
                EXTRACT: "CA10__engine__c"
              right:
                TEXT: "docdb"
          - CONTAINS:
              arg:
                EXTRACT: "CA10__enabledCloudwatchLogsExports__c"
              search:
                TEXT: "audit"
  - status: "INCOMPLIANT"
    currentStateMessage: "Neptune audit logs are not exported to CloudWatch Logs."
    remediationMessage: "Enable export of audit logs to CloudWatch Logs for the Amazon Neptune cluster."
    check:
      AND:
        args:
          - IS_EQUAL:
              left:
                EXTRACT: "CA10__engine__c"
              right:
                TEXT: "neptune"
          - NOT:
              arg:
                CONTAINS:
                  arg:
                    EXTRACT: "CA10__enabledCloudwatchLogsExports__c"
                  search:
                    TEXT: "audit"
  - status: "COMPLIANT"
    currentStateMessage: "Neptune audit logs are exported to CloudWatch Logs."
    check:
      AND:
        args:
          - IS_EQUAL:
              left:
                EXTRACT: "CA10__engine__c"
              right:
                TEXT: "neptune"
          - CONTAINS:
              arg:
                EXTRACT: "CA10__enabledCloudwatchLogsExports__c"
              search:
                TEXT: "audit"
otherwise:
  status: "UNDETERMINED"
  currentStateMessage: "Unexpected values were found in the engine or CloudWatch log export configuration."

Uses​

Test Results 🟢​

Generation Bundle​

Available Commands​

Content​

Uses

Test Results 🟢

Generation Bundle

Available Commands

Content