DocumentDB cluster should export audit logs to CloudWatch

What it checks

DocumentDB cluster should export audit logs to CloudWatch

Where it applies

Terraform: aws_docdb_cluster

CloudFormation: AWS::DocDB::DBCluster

How to fix it

1. Set enabled_cloudwatch_logs_exports = ["audit"] and enable audit_logs in the cluster parameter group.

Frameworks

• SOC 2 CC7.2
• HIPAA 164.312(b)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules