RDS.34: Aurora MySQL clusters should export audit logs to CW

What does AWS Security Hub RDS.34 check?

RDS.34 checks whether an Aurora MySQL DB cluster publishes its audit logs to CloudWatch Logs. It reports FAILED when audit is not in the cluster's CloudWatch Logs exports. It does not generate findings for Aurora Serverless v1 clusters.

Why does RDS.34 matter?

RDS.34 is not about whether auditing is switched on — it is about whether the resulting logs are shipped somewhere durable. A cluster can be diligently writing audit records (who logged in, what queries ran, what schema changed) and still fail, because by default that trail lives only on the database host where it rotates, ages out, and disappears the moment the instance is replaced or recovered. Logs that only exist locally are logs you effectively do not have when you need them most. It maps to logging and accountability requirements in NIST 800-53 and PCI DSS 4.0.1.

How do I fix RDS.34?

1. Ensure the audit log is being generated (the Advanced Auditing plugin enabled in the cluster parameter group).
2. Add audit to the cluster's CloudWatch Logs exports with modify-db-cluster --cloudwatch-logs-exports-configuration.
3. Set a retention policy on the resulting log group and build metric filters/alarms on the audit stream.
4. Standardise this across Aurora MySQL clusters in IaC.

# Move the highest-impact databases onto IAM authentication first (free, no reboot).
for db in $(aws rds describe-db-instances \
    --query 'DBInstances[?IAMDatabaseAuthenticationEnabled==`false`].DBInstanceIdentifier' \
    --output text); do
  aws rds modify-db-instance --db-instance-identifier "$db" \
    --enable-iam-database-authentication --apply-immediately
  echo "$db: IAM database authentication enabled"
done

# Find every instance still using a default admin username (immutable; needs migration).
aws rds describe-db-instances \
  --query "DBInstances[?contains(['admin','postgres','root','sa','master','mysql','dbadmin'], MasterUsername)].[DBInstanceIdentifier,MasterUsername]" \
  --output table

# Recreate one of those with a non-default master username set explicitly at creation.
aws rds restore-db-cluster-from-snapshot \
  --db-cluster-identifier prod-orders-db-v2 \
  --snapshot-identifier prod-orders-db-pre-rename \
  --engine aurora-postgresql