Amazon MQ for ActiveMQ broker should enable audit logging to CloudWatch

What it checks

Amazon MQ for ActiveMQ broker should enable audit logging to CloudWatch

Where it applies

Terraform: aws_mq_broker

CloudFormation: AWS::AmazonMQ::Broker

How to fix it

1. Add a logs block with audit = true (and general = true) to the ActiveMQ broker. Enabling logs requires the broker's user to hold logs:CreateLogGroup and a CloudWatch Logs resource policy for mq.amazonaws.com; changing the logs configuration reboots the broker.

Frameworks

• SOC 2 CC7.2
• HIPAA 164.312(b)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules