DocDB Logging Is Disabled

Query id: 2ca87964-fe7e-4cdc-899c-427f0f3525f8
Query name: DocDB Logging Is Disabled
Platform: Pulumi
Severity: Low
Category: Observability
URL: Github

Description¶

DocDB logging should be enabled
Documentation

Code samples¶

Code samples with security vulnerabilities¶

Postitive test num. 1 - yaml file

name: my-pulumi-project
runtime: nodejs

config:
  aws:region: us-east-1

resources:
  aws:docdb/cluster:
    type: aws:docdb:Cluster
    properties:
      backupRetentionPeriod: 5
      clusterIdentifier: my-docdb-cluster
      engine: docdb
      masterPassword: mustbeeightchars
      masterUsername: foo
      preferredBackupWindow: 07:00-09:00
      skipFinalSnapshot: true

Postitive test num. 2 - yaml file

name: my-pulumi-project
runtime: nodejs

config:
  aws:region: us-east-1

resources:
  aws:docdb/cluster:
    type: aws:docdb:Cluster
    properties:
      backupRetentionPeriod: 5
      clusterIdentifier: my-docdb-cluster
      engine: docdb
      masterPassword: mustbeeightchars
      masterUsername: foo
      preferredBackupWindow: 07:00-09:00
      skipFinalSnapshot: true
      enabledCloudwatchLogsExports: []

Postitive test num. 3 - yaml file

name: my-pulumi-project
runtime: nodejs

config:
  aws:region: us-east-1

resources:
  aws:docdb/cluster:
    type: aws:docdb:Cluster
    properties:
      backupRetentionPeriod: 5
      clusterIdentifier: my-docdb-cluster
      engine: docdb
      masterPassword: mustbeeightchars
      masterUsername: foo
      preferredBackupWindow: 07:00-09:00
      skipFinalSnapshot: true
      enabledCloudwatchLogsExports:
        - audit

Code samples without security vulnerabilities¶

Negative test num. 1 - yaml file

name: my-pulumi-project
runtime: nodejs

config:
  aws:region: us-east-1

resources:
  aws:docdb/cluster:
    type: aws:docdb:Cluster
    properties:
      backupRetentionPeriod: 5
      clusterIdentifier: my-docdb-cluster
      engine: docdb
      masterPassword: mustbeeightchars
      masterUsername: foo
      preferredBackupWindow: 07:00-09:00
      skipFinalSnapshot: true
      enabledCloudwatchLogsExports:
        - audit
        - profiler