AWS Security Hub · MSK
MSK.5: MSK connectors should have logging
Written and reviewed by Emnode · Last reviewed
What does AWS Security Hub MSK.5 check?
MSK.5 fails when an MSK Connect connector has no log destination configured. The control requires at least one of the three targets (CloudWatch Logs, S3, or Data Firehose) to be set on the connector.
Why does MSK.5 matter?
A connector with no log destination sends its diagnostics nowhere. When a downstream schema change starts rejecting a subset of records, the rejects vanish silently and the pipeline looks healthy because most records still flow, until weeks later a business metric turns out undercounted with no trail to explain it. A log destination makes those rejections visible the moment they start.
How do I fix MSK.5?
- Audit connectors for any with no log configuration set.
- Choose a destination (CloudWatch Logs, S3, or Data Firehose) and recreate the connector with logging enabled, since logging is immutable after creation.
- Repoint the workload at the new connector and retire the old one.
- Make a log destination mandatory in your connector provisioning.
Remediation script · bash
# Verify the prerequisite first: API Gateway's account-level CloudWatch role.
# Without it, the logging setting saves but no logs ever flow.
aws apigateway get-account --query 'cloudwatchRoleArn' --output text
# Enable ERROR-level execution logging on every stage of a REST API.
REST_API=a1b2c3d4e5
for STAGE in $(aws apigateway get-stages --rest-api-id $REST_API \
--query 'item[].stageName' --output text); do
aws apigateway update-stage --rest-api-id $REST_API --stage-name $STAGE \
--patch-operations op=replace,path=/*/*/logging/loglevel,value=ERROR
done
# Cap retention on the log group so storage stays bounded (do this every time you enable logging).
aws logs put-retention-policy \
--log-group-name "API-Gateway-Execution-Logs_${REST_API}/prod" \
--retention-in-days 90
# Example for a managed database: publish engine logs to CloudWatch (no per-event charge).
aws rds modify-db-instance --db-instance-identifier prod-db \
--cloudwatch-logs-export-configuration 'EnableLogTypes=["error","audit"]' --apply-immediatelyFull walkthrough (console steps, edge cases and verification) in the lesson Enable application and API logging.
Is MSK.5 a false positive?
Logging cannot be added to an existing connector (it is set at creation only), so a connector built without it stays FAILED until it is recreated with a log destination.