> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Mq cloudwatch audit logging enabled remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration of MQ Brokers having CloudWatch audit logging enabled for AWS Security Groups using the AWS console, follow these steps:

        1. **Access AWS Console**: Log in to your AWS Management Console using your credentials.

        2. **Navigate to Amazon MQ Service**: Go to the Amazon MQ service by either searching for it in the AWS services search bar or locating it under the "Messaging & Queueing" section.

        3. **Select the MQ Broker**: Select the MQ Broker for which you want to remediate the CloudWatch audit logging configuration.

        4. **Modify Broker**: Click on the "Actions" dropdown menu and select "Modify Broker".

        5. **Update Broker Configuration**: In the "Broker Details" section, scroll down to the "Logs" section.

        6. **Disable CloudWatch Audit Logging**: Locate the "CloudWatch Audit Logging" option and disable it by unchecking the box or selecting "Disabled" from the dropdown menu.

        7. **Save Changes**: Scroll to the bottom of the page and click on the "Modify" button to save the changes.

        8. **Verify Configuration**: Once the changes are saved, verify that CloudWatch audit logging is disabled for the MQ Broker by checking the broker's configuration settings.

        By following these steps, you will successfully remediate the misconfiguration of MQ Brokers having CloudWatch audit logging enabled for AWS Security Groups using the AWS console.
      </Accordion>

      <Accordion title="Using CLI">
        #

        To remediate the misconfiguration of MQ Brokers having CloudWatch audit logging enabled for AWS Security Groups using AWS CLI, follow these steps:

        1. **Identify the AWS Security Groups associated with the MQ Brokers**:
           * Run the following AWS CLI command to list all the AWS Security Groups associated with the MQ Brokers:
             ```
             aws mq list-brokers
             ```
           * Note down the Security Group IDs associated with the MQ Brokers.

        2. **Disable CloudWatch audit logging for the identified Security Groups**:
           * Run the following AWS CLI command for each Security Group ID to disable CloudWatch audit logging:
             ```
             aws mq update-broker --broker-id <BROKER_ID> --logging { "audit": false }
             ```
           Replace `<BROKER_ID>` with the actual ID of the MQ Broker associated with the Security Group.

        3. **Verify the changes**:
           * Run the following AWS CLI command to describe the MQ Broker and verify that CloudWatch audit logging is disabled for the Security Group:
             ```
             aws mq describe-broker --broker-id <BROKER_ID>
             ```
           Replace `<BROKER_ID>` with the actual ID of the MQ Broker associated with the Security Group.

        4. **Repeat for other Security Groups**:
           * If there are multiple Security Groups associated with the MQ Brokers, repeat steps 2 and 3 for each Security Group.

        By following these steps, you can remediate the misconfiguration of MQ Brokers having CloudWatch audit logging enabled for AWS Security Groups using AWS CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration of MQ Brokers having CloudWatch audit logging enabled for AWS Security Groups using Python, you can follow these steps:

        1. **Identify the Security Groups**: First, you need to identify the Security Groups associated with your MQ Brokers.

        2. **Disable CloudWatch Audit Logging**: You can use the AWS SDK for Python (Boto3) to disable CloudWatch audit logging for the identified Security Groups. Here is a sample Python code snippet to achieve this:

        ```python theme={null}
        import boto3

        # Initialize the AWS clients
        ec2_client = boto3.client('ec2')

        # Specify the Security Group IDs of the MQ Brokers
        security_group_ids = ['sg-12345678', 'sg-87654321']

        # Disable CloudWatch Audit Logging for each Security Group
        for sg_id in security_group_ids:
            response = ec2_client.modify_flow_logs(
                DeliverLogsPermissionArn='',
                LogGroupName='',
                ResourceIds=[sg_id],
                ResourceType='VPC',
                TrafficType='ALL',
                LogDestinationType='cloud-watch-logs',
                LogDestination=''
            )
            print(f"CloudWatch Audit Logging disabled for Security Group {sg_id}")
        ```

        3. **Run the Python Script**: Save the above Python script in a file (e.g., `remediate_security_groups.py`) and execute it using Python. Make sure you have the necessary IAM permissions to modify the Security Groups.

        By following these steps and executing the Python script, you can remediate the misconfiguration of MQ Brokers having CloudWatch audit logging enabled for AWS Security Groups.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "aws_mq_broker" "MQ_BROKER_NAME" {
          # Replace with your broker settings
          broker_name        = "MQ_BROKER_NAME"        # replace with your broker name
          engine_type        = "ActiveMQ"              # or "RabbitMQ" as appropriate
          engine_version     = "ENGINE_VERSION"        # e.g. "5.15.14"
          host_instance_type = "mq.t3.micro"           # replace with your instance type
          publicly_accessible = false

          # ...other required configuration (users, subnet_ids, security_groups, etc.)...

          logs {
            audit = true
            # The CLI fix only changes "Audit", so do not alter "general" here unless desired
            # general = true | false
          }
        }
        ```

        This change enables CloudWatch audit logging on the broker, matching `--logs '{"Audit":true}'`. It will trigger a rolling update of active/standby brokers (brief outage) but does not force resource replacement; `terraform plan` should show an in-place update changing `logs.audit` from `false` (or null) to `true`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>