1. Sign in to the AWS Management Console: Go to https://aws.amazon.com/ and sign in to the AWS Management Console using your credentials.
2. Navigate to Amazon RDS Console: Once you are logged in, navigate to the Amazon RDS console by clicking on the “Services” dropdown menu at the top of the page and selecting “RDS” under the “Database” category.
3. Select the Amazon DocumentDB Cluster: In the Amazon RDS console, locate and select the Amazon DocumentDB cluster for which you want to enable audit logging.
4. Enable Audit Logging:
   • In the cluster details page, click on the “Modify” button in the upper right corner.
   • Scroll down to the “Database options” section.
   • Under the “Audit log configuration” section, select “Enable” for the “Audit log” option.
   • Choose the desired settings for the audit log, such as the S3 bucket where the logs will be stored, the IAM role that has permission to write to the bucket, and the KMS key for encryption (if needed).
   • Click on the “Continue” button.
5. Apply Changes: Review the changes you have made in the “Summary of modifications” section. If everything looks correct, click on the “Modify cluster” button to apply the changes.
6. Monitor Audit Logging Status: Once the modifications are applied, monitor the status of the audit logging configuration in the Amazon DocumentDB cluster details page. The status should change to “applying” and then “active” once the audit logging is successfully enabled.

​

1. Enable Logging for the Amazon DocumentDB Cluster: Run the following AWS CLI command to enable audit logging for your Amazon DocumentDB cluster. Replace cluster-identifier with the actual identifier of your DocumentDB cluster.
   aws docdb modify-db-cluster --db-cluster-identifier <cluster-identifier> --enable-cloudwatch-logs-exports '["audit"]'
   
2. Verify the Audit Logging Configuration: Run the following command to verify that the audit logging configuration has been successfully updated for your DocumentDB cluster.
   aws docdb describe-db-clusters --db-cluster-identifier <cluster-identifier> --query 'DBClusters[0].EnabledCloudwatchLogsExports'
   
   This command should return an array with the value [ "audit" ], indicating that audit logging has been enabled.
3. Monitor the CloudWatch Logs: Once the audit logging is enabled, you can monitor the logs in CloudWatch Logs to ensure that all the database activities are being logged appropriately.

1. Import the necessary Python libraries, such as boto3, which is the AWS SDK for Python.

import boto3

2. Initialize the AWS RDS client using the boto3.client method.

rds_client = boto3.client('rds')

3. Identify the DocDB Cluster for which you want to enable audit logging. You can do this by specifying the DBClusterIdentifier of the DocDB Cluster.

docdb_cluster_identifier = 'your-docdb-cluster-identifier'

4. Enable audit logging for the DocDB Cluster by calling the modify_db_cluster method of the RDS client with the EnableCloudwatchLogsExports parameter set to include 'audit'.

response = rds_client.modify_db_cluster(
    DBClusterIdentifier=docdb_cluster_identifier,
    EnableCloudwatchLogsExports=[
        'audit'
    ]
)

5. Verify that the audit logging has been enabled successfully by checking the response from the modify_db_cluster API call.

print(response)

# Custom parameter group with audit logging enabled.
# If you currently use a default or shared parameter group, create a NEW one like this
# and point ONLY this cluster at it to avoid side effects on other clusters.

resource "aws_docdb_cluster_parameter_group" "DOCDB_AUDIT_PG" {
  name        = "DOCDB_AUDIT_PARAMETER_GROUP_NAME" # replace with a unique name
  family      = "docdb5.0"                         # replace with the correct family for your engine version
  description = "DocDB cluster parameter group with audit logs enabled"

  parameter {
    name  = "audit_logs"
    value = "enabled"
  }
}

resource "aws_docdb_cluster" "DOCDB_CLUSTER" {
  cluster_identifier              = "DOCDB_CLUSTER_IDENTIFIER"     # replace with your cluster identifier
  engine                          = "docdb"
  master_username                 = "MASTER_USERNAME"              # replace securely (e.g., from SSM/Secrets Manager)
  master_password                 = "MASTER_PASSWORD"              # replace securely
  db_subnet_group_name            = "DOCDB_SUBNET_GROUP_NAME"      # replace with your subnet group
  vpc_security_group_ids          = ["SG_ID_1", "SG_ID_2"]         # replace with your SG IDs
  db_cluster_parameter_group_name = aws_docdb_cluster_parameter_group.DOCDB_AUDIT_PG.name

  # This enables export of 'audit' logs to CloudWatch Logs for the cluster,
  # matching: --cloudwatch-logs-export-configuration '{"EnableLogTypes":["audit"]}'
  enabled_cloudwatch_logs_exports = ["audit"]

  # ...any other required arguments for your environment...
}

• an aws_docdb_cluster_parameter_group with parameter.audit_logs changing to "enabled" (or being created with that value), and
• the aws_docdb_cluster gaining/setting enabled_cloudwatch_logs_exports = ["audit"] and (if needed) updating db_cluster_parameter_group_name to the new group.