# Cis AWS Database 6.4

> Ensure Audit Logging is Enabled

- Skill: `cyberstrikeus/cis-aws-database-6-4` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-aws-database-6-4`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-aws-database-6-4/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cyberstrikeus/cis-aws-database-6-4

---


# 6.4 Ensure Audit Logging is Enabled (Manual)

## Description

Enabling audit logging on Amazon MemoryDB allows you to capture and store logs of activities performed on your clusters.

## Rationale

It captures and saves logs of activities that took place in the cluster.

## Impact

Reduces risks of any fraud since worker activity is being monitored and tracked.

## Audit Procedure

### Using AWS Console

1. Sign into the AWS Management Console
   - Sign into the AWS Management Console at https://console.aws.amazon.com/ with your AWS account credentials.

2. Open the Amazon MemoryDB Console
   - Navigate to the service using the `Find Services` search bar or by directly accessing the console at https://console.aws.amazon.com/memorydb/.

3. Select the Cluster
   - Choose the MemoryDB cluster for which you want to enable audit logging. Click on the cluster name to access its details page.

4. Enable Amazon CloudWatch Logs
   - In the cluster details page, navigate to the `Logging` section.
   - Click on `Modify` to edit the logging settings.
   - Select the option to enable CloudWatch Logs.
   - Choose an existing CloudWatch log group or create a new one to store the logs generated by the MemoryDB cluster activities.
   - Optionally, you can specify a log retention period to define how long the logs will be stored.
   - Click `Apply Changes` to enable CloudWatch Logs for the MemoryDB cluster.

5. Configure CloudWatch Logs
   - Open the CloudWatch console by navigating to `CloudWatch` in the AWS Management Console.
   - In the left-side menu, click on `Logs`.
   - Create a new log group or select an existing log group that will store the MemoryDB logs.
   - Configure log retention settings based on your retention requirements. Logs can be stored for a specific number of days or indefinitely.
   - Define any necessary log group permissions to control access to the logs.
   - Optionally, set up log exports or alarms for specific log events or patterns if needed.

6. Verify Logging Status
   - Wait a few minutes for the changes to propagate and the logging configuration to take effect.
   - Refresh the cluster details page to see the updated logging status.
   - Verify that CloudWatch Logs is enabled for the MemoryDB cluster.

7. Monitor and Analyze Logs
   - Navigate to the CloudWatch console and select the log group that stores the MemoryDB logs.
   - Monitor the logs to gain insights into the activities and operations performed on your MemoryDB cluster.
   - Use CloudWatch Logs features, such as log searching, filtering, and visualization, to analyze the logs and identify any security or operational issues.
   - Establish appropriate log monitoring and alerting mechanisms to proactively identify and respond to potential security incidents or operational anomalies.

## Expected Result

CloudWatch Logs is enabled for all MemoryDB clusters with appropriate log groups and retention periods configured.

## Remediation

### Using AWS Console

Follow the audit procedure steps to enable CloudWatch Logs for each MemoryDB cluster and configure appropriate log retention and monitoring.

## Default Value

Audit logging is not enabled by default for Amazon MemoryDB for Redis.

## References

1. https://aws.amazon.com/products/databases/

## CIS Controls

| Controls Version | Control                                                    | IG 1 | IG 2 | IG 3 |
| ---------------- | ---------------------------------------------------------- | ---- | ---- | ---- |
| v8               | 8.1 Establish and Maintain an Audit Log Management Process | X    | X    | X    |
| v7               | 6.2 Activate audit logging                                 | X    | X    | X    |

## Profile

Level 1 | Manual