RDS.42: RDS MariaDB should export logs to CW

What does AWS Security Hub RDS.42 check?

RDS.42 checks whether an RDS for MariaDB instance (AWS::RDS::DBInstance) publishes its logs to CloudWatch Logs. It knows four log types — audit, error, general, and slowquery — and by default expects at least audit and error to be exported, failing the instance otherwise. It is evaluated periodically.

Why does RDS.42 matter?

A MariaDB instance writes its error, general, slow-query, and audit logs to the managed database host by default. You can view recent slices in the console or pull them with an API call, but they rotate, are size-capped, and vanish the moment the instance is replaced, scaled, or fails over. Logs you can't reach are logs you can't use — the difference between "the evidence rotated away" and "here is exactly who connected, what ran, and when."

How do I fix RDS.42?

1. Enable the export with modify-db-instance --cloudwatch-logs-exports-configuration 'EnableLogTypes=["audit","error"]' (add slowquery as useful; avoid general in production for cost).
2. Set a retention policy on the resulting log groups.
3. Build metric filters and alarms on the exported streams.
4. Standardise the export across MariaDB instances in IaC.

# Verify the prerequisite first: API Gateway's account-level CloudWatch role.
# Without it, the logging setting saves but no logs ever flow.
aws apigateway get-account --query 'cloudwatchRoleArn' --output text

# Enable ERROR-level execution logging on every stage of a REST API.
REST_API=a1b2c3d4e5
for STAGE in $(aws apigateway get-stages --rest-api-id $REST_API \
  --query 'item[].stageName' --output text); do
  aws apigateway update-stage --rest-api-id $REST_API --stage-name $STAGE \
    --patch-operations op=replace,path=/*/*/logging/loglevel,value=ERROR
done

# Cap retention on the log group so storage stays bounded (do this every time you enable logging).
aws logs put-retention-policy \
  --log-group-name "API-Gateway-Execution-Logs_${REST_API}/prod" \
  --retention-in-days 90

# Example for a managed database: publish engine logs to CloudWatch (no per-event charge).
aws rds modify-db-instance --db-instance-identifier prod-db \
  --cloudwatch-logs-export-configuration 'EnableLogTypes=["error","audit"]' --apply-immediately