AWS Security Hub · DataSync
DataSync.1: DataSync tasks should have logging enabled
Written and reviewed by Emnode · Last reviewed
What does AWS Security Hub DataSync.1 check?
DataSync.1 checks whether a DataSync task publishes logs to CloudWatch Logs. It fails when the task's LogLevel is OFF and passes when it is BASIC or TRANSFER. A task created without an explicit level runs silently.
Why does DataSync.1 matter?
A task running at LogLevel OFF transfers data with no per-run record of what moved, what was skipped, or what failed integrity verification. The transfer succeeds the same way it would with logging on; the difference only shows up after the fact. A failed migration leaves you unable to tell which files arrived; a compliance review or incident asking prove these 40,000 files copied intact has nothing to point at, and by then the runs are gone.
How do I fix DataSync.1?
- Set the task's LogLevel to TRANSFER (per-file detail) or at least BASIC.
- Configure a CloudWatch Logs group as the task's log destination.
- Grant DataSync permission to write to that log group, then run the task and confirm logs appear.
Remediation script · bash
# Verify the prerequisite first: API Gateway's account-level CloudWatch role.
# Without it, the logging setting saves but no logs ever flow.
aws apigateway get-account --query 'cloudwatchRoleArn' --output text
# Enable ERROR-level execution logging on every stage of a REST API.
REST_API=a1b2c3d4e5
for STAGE in $(aws apigateway get-stages --rest-api-id $REST_API \
--query 'item[].stageName' --output text); do
aws apigateway update-stage --rest-api-id $REST_API --stage-name $STAGE \
--patch-operations op=replace,path=/*/*/logging/loglevel,value=ERROR
done
# Cap retention on the log group so storage stays bounded (do this every time you enable logging).
aws logs put-retention-policy \
--log-group-name "API-Gateway-Execution-Logs_${REST_API}/prod" \
--retention-in-days 90
# Example for a managed database: publish engine logs to CloudWatch (no per-event charge).
aws rds modify-db-instance --db-instance-identifier prod-db \
--cloudwatch-logs-export-configuration 'EnableLogTypes=["error","audit"]' --apply-immediatelyFull walkthrough (console steps, edge cases and verification) in the lesson Enable application and API logging.
Is DataSync.1 a false positive?
A task that already routes its per-object detail to a CloudWatch destination is sometimes set to LogLevel BASIC on purpose, for example a very high-frequency or very high-volume transfer where TRANSFER-level per-file logging would generate enough log data to dominate the job's CloudWatch Logs bill without adding investigative value. BASIC still passes the control, so this is not actually a finding; if a task is genuinely set to OFF for a deliberate reason (such as a throwaway one-off copy of non-sensitive data with no audit requirement), confirm that reasoning is documented and suppress the finding rather than bolting on a log group the team will never read.