Redshift cluster does not have audit logging enabled
- Severity
- Medium
- Service
- Redshift
- Check ID
- REDSHIFT_AUDIT_LOGGING_DISABLED
What this check finds
The cluster has audit logging disabled (LoggingEnabled=false), so connection attempts, user activity, and queries are not recorded. Without these logs, unauthorized access, data exfiltration, and misuse cannot be investigated after the fact and many compliance regimes are not met.
Passing looks like: Redshift audit logging enabled.
How to fix it
Enable audit logging to S3 or CloudWatch.
AWS CLI
aws redshift enable-logging --cluster-identifier CLUSTER_ID --log-destination-type cloudwatch --log-exports connectionlog userlog useractivitylog
Names in capitals are placeholders for your own resource. Review a command before you run it.
AWS console
Redshift → Clusters → select cluster → Properties → Audit logging → Edit.
Compliance controls it is evidence for
A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works
| Framework | Controls |
|---|---|
| NIST SP 800-53 Rev5 (Moderate) |
|
| NIST Cybersecurity Framework 2.0 |
|
| ISO/IEC 27001:2022 Annex A |
|
Checked on every scan
KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs