DocumentDB.4: DocumentDB clusters should export audit logs to CW

What does AWS Security Hub DocumentDB.4 check?

DocumentDB.4 checks whether a cluster publishes audit logs to Amazon CloudWatch Logs. It reports FAILED when the cluster isn't exporting the `audit` log type — auditing is disabled by default on a new cluster, so it records nothing until deliberately switched on.

Why does DocumentDB.4 matter?

Without an audit trail, the record of who authenticated, created a user, dropped a collection, or ran a query simply doesn't exist. Everything looks fine until an incident or an auditor asks 'who dropped that collection?' and the honest answer is 'we have no way to know.' It maps to NIST AU-2/AU-3/AU-12 and PCI DSS 10.3.3 — accountability controls where an event with no recorded actor effectively never happened.

How do I fix DocumentDB.4?

1. Create a custom cluster parameter group with the `audit_logs` parameter enabled and attach it to the cluster.
2. Enable the CloudWatch Logs export for the `audit` log type on the cluster.
3. Set log-group retention and consider DML filtering to control volume.
4. Make the audited configuration the default for new clusters so they arrive compliant.

# Move the highest-impact databases onto IAM authentication first (free, no reboot).
for db in $(aws rds describe-db-instances \
    --query 'DBInstances[?IAMDatabaseAuthenticationEnabled==`false`].DBInstanceIdentifier' \
    --output text); do
  aws rds modify-db-instance --db-instance-identifier "$db" \
    --enable-iam-database-authentication --apply-immediately
  echo "$db: IAM database authentication enabled"
done

# Find every instance still using a default admin username (immutable; needs migration).
aws rds describe-db-instances \
  --query "DBInstances[?contains(['admin','postgres','root','sa','master','mysql','dbadmin'], MasterUsername)].[DBInstanceIdentifier,MasterUsername]" \
  --output table

# Recreate one of those with a non-default master username set explicitly at creation.
aws rds restore-db-cluster-from-snapshot \
  --db-cluster-identifier prod-orders-db-v2 \
  --snapshot-identifier prod-orders-db-pre-rename \
  --engine aurora-postgresql