Opensearch.5: OpenSearch domains should have audit logging

What does AWS Security Hub Opensearch.5 check?

Opensearch.5 fails when a domain is not publishing audit logs (the AUDIT_LOGS log type) to CloudWatch Logs. Audit logs capture authentication events and the requests principals make against the cluster.

Why does Opensearch.5 matter?

Without audit logs there is no record of who searched what, which leaves you unable to investigate misuse or prove access controls work to an auditor. For a data store that may hold sensitive indexes, the absence of an access trail is a real gap in both incident response and compliance evidence.

How do I fix Opensearch.5?

1. Confirm fine-grained access control is enabled, since audit logging cannot be turned on without it.
2. Create a CloudWatch Logs log group and attach a resource policy allowing OpenSearch to write to it.
3. Enable the AUDIT_LOGS publishing option with update-domain-config.
4. Add a Config rule so new domains keep audit logging on.

# Enable CloudWatch log export on a flagged RDS instance, then cap retention.
aws rds modify-db-instance \
  --db-instance-identifier prod-orders-pg \
  --cloudwatch-logs-exports-configuration 'EnableLogTypes=["postgresql","upgrade"]' \
  --apply-immediately

aws logs put-retention-policy \
  --log-group-name /aws/rds/instance/prod-orders-pg/postgresql \
  --retention-in-days 90

# Enable audit logging on a Redshift cluster to a policy-attached S3 bucket.
aws redshift enable-logging \
  --cluster-identifier analytics-prod \
  --bucket-name redshift-audit-logs-acct123 \
  --s3-key-prefix analytics-prod/