> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Docdb cluster audit logging enabled remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the DocDB Cluster Audit Logging misconfiguration for AWS RDS using the AWS console, follow these step-by-step instructions:

        1. **Sign in to the AWS Management Console**: Go to [https://aws.amazon.com/](https://aws.amazon.com/) and sign in to the AWS Management Console using your credentials.

        2. **Navigate to Amazon RDS Console**: Once you are logged in, navigate to the Amazon RDS console by clicking on the "Services" dropdown menu at the top of the page and selecting "RDS" under the "Database" category.

        3. **Select the Amazon DocumentDB Cluster**: In the Amazon RDS console, locate and select the Amazon DocumentDB cluster for which you want to enable audit logging.

        4. **Enable Audit Logging**:
           * In the cluster details page, click on the "Modify" button in the upper right corner.
           * Scroll down to the "Database options" section.
           * Under the "Audit log configuration" section, select "Enable" for the "Audit log" option.
           * Choose the desired settings for the audit log, such as the S3 bucket where the logs will be stored, the IAM role that has permission to write to the bucket, and the KMS key for encryption (if needed).
           * Click on the "Continue" button.

        5. **Apply Changes**: Review the changes you have made in the "Summary of modifications" section. If everything looks correct, click on the "Modify cluster" button to apply the changes.

        6. **Monitor Audit Logging Status**: Once the modifications are applied, monitor the status of the audit logging configuration in the Amazon DocumentDB cluster details page. The status should change to "applying" and then "active" once the audit logging is successfully enabled.

        By following these steps, you will remediate the misconfiguration by enabling audit logging for your Amazon DocumentDB cluster in AWS RDS using the AWS console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration of DocDB Cluster Audit Logging not being enabled for AWS RDS using AWS CLI, follow these steps:

        1. **Enable Logging for the Amazon DocumentDB Cluster**:

           Run the following AWS CLI command to enable audit logging for your Amazon DocumentDB cluster. Replace `cluster-identifier` with the actual identifier of your DocumentDB cluster.

           ```bash theme={null}
           aws docdb modify-db-cluster --db-cluster-identifier <cluster-identifier> --enable-cloudwatch-logs-exports '["audit"]'
           ```

        2. **Verify the Audit Logging Configuration**:

           Run the following command to verify that the audit logging configuration has been successfully updated for your DocumentDB cluster.

           ```bash theme={null}
           aws docdb describe-db-clusters --db-cluster-identifier <cluster-identifier> --query 'DBClusters[0].EnabledCloudwatchLogsExports'
           ```

           This command should return an array with the value `[ "audit" ]`, indicating that audit logging has been enabled.

        3. **Monitor the CloudWatch Logs**:

           Once the audit logging is enabled, you can monitor the logs in CloudWatch Logs to ensure that all the database activities are being logged appropriately.

        By following these steps, you can remediate the misconfiguration of DocDB Cluster Audit Logging not being enabled for AWS RDS using AWS CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration of DocDB Cluster Audit Logging not being enabled for AWS RDS using Python, you can follow these steps:

        1. Import the necessary Python libraries, such as `boto3`, which is the AWS SDK for Python.

        ```python theme={null}
        import boto3
        ```

        2. Initialize the AWS RDS client using the `boto3.client` method.

        ```python theme={null}
        rds_client = boto3.client('rds')
        ```

        3. Identify the DocDB Cluster for which you want to enable audit logging. You can do this by specifying the `DBClusterIdentifier` of the DocDB Cluster.

        ```python theme={null}
        docdb_cluster_identifier = 'your-docdb-cluster-identifier'
        ```

        4. Enable audit logging for the DocDB Cluster by calling the `modify_db_cluster` method of the RDS client with the `EnableCloudwatchLogsExports` parameter set to include `'audit'`.

        ```python theme={null}
        response = rds_client.modify_db_cluster(
            DBClusterIdentifier=docdb_cluster_identifier,
            EnableCloudwatchLogsExports=[
                'audit'
            ]
        )
        ```

        5. Verify that the audit logging has been enabled successfully by checking the response from the `modify_db_cluster` API call.

        ```python theme={null}
        print(response)
        ```

        By following these steps and running the Python script, you can remediate the misconfiguration of DocDB Cluster Audit Logging not being enabled for AWS RDS.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # Custom parameter group with audit logging enabled.
        # If you currently use a default or shared parameter group, create a NEW one like this
        # and point ONLY this cluster at it to avoid side effects on other clusters.

        resource "aws_docdb_cluster_parameter_group" "DOCDB_AUDIT_PG" {
          name        = "DOCDB_AUDIT_PARAMETER_GROUP_NAME" # replace with a unique name
          family      = "docdb5.0"                         # replace with the correct family for your engine version
          description = "DocDB cluster parameter group with audit logs enabled"

          parameter {
            name  = "audit_logs"
            value = "enabled"
          }
        }

        resource "aws_docdb_cluster" "DOCDB_CLUSTER" {
          cluster_identifier              = "DOCDB_CLUSTER_IDENTIFIER"     # replace with your cluster identifier
          engine                          = "docdb"
          master_username                 = "MASTER_USERNAME"              # replace securely (e.g., from SSM/Secrets Manager)
          master_password                 = "MASTER_PASSWORD"              # replace securely
          db_subnet_group_name            = "DOCDB_SUBNET_GROUP_NAME"      # replace with your subnet group
          vpc_security_group_ids          = ["SG_ID_1", "SG_ID_2"]         # replace with your SG IDs
          db_cluster_parameter_group_name = aws_docdb_cluster_parameter_group.DOCDB_AUDIT_PG.name

          # This enables export of 'audit' logs to CloudWatch Logs for the cluster,
          # matching: --cloudwatch-logs-export-configuration '{"EnableLogTypes":["audit"]}'
          enabled_cloudwatch_logs_exports = ["audit"]

          # ...any other required arguments for your environment...
        }
        ```

        Enabling `audit_logs` in the parameter group will affect all clusters that use that group; if you currently share it, create and attach a dedicated parameter group as shown above. These changes are in-place (no Terraform-forced replacement of the cluster), though some settings may apply after a pending-reboot.

        To verify, `terraform plan` should show:

        * an `aws_docdb_cluster_parameter_group` with `parameter.audit_logs` changing to `"enabled"` (or being created with that value), and
        * the `aws_docdb_cluster` gaining/setting `enabled_cloudwatch_logs_exports = ["audit"]` and (if needed) updating `db_cluster_parameter_group_name` to the new group.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>