1. Access AWS Console: Log in to your AWS Management Console using your credentials.
2. Navigate to Amazon MQ Service: Go to the Amazon MQ service by either searching for it in the AWS services search bar or locating it under the “Messaging & Queueing” section.
3. Select the MQ Broker: Select the MQ Broker for which you want to remediate the CloudWatch audit logging configuration.
4. Modify Broker: Click on the “Actions” dropdown menu and select “Modify Broker”.
5. Update Broker Configuration: In the “Broker Details” section, scroll down to the “Logs” section.
6. Disable CloudWatch Audit Logging: Locate the “CloudWatch Audit Logging” option and disable it by unchecking the box or selecting “Disabled” from the dropdown menu.
7. Save Changes: Scroll to the bottom of the page and click on the “Modify” button to save the changes.
8. Verify Configuration: Once the changes are saved, verify that CloudWatch audit logging is disabled for the MQ Broker by checking the broker’s configuration settings.

​

1. Identify the AWS Security Groups associated with the MQ Brokers:
   • Run the following AWS CLI command to list all the AWS Security Groups associated with the MQ Brokers:
     aws mq list-brokers
     
   • Note down the Security Group IDs associated with the MQ Brokers.
2. Disable CloudWatch audit logging for the identified Security Groups:
   • Run the following AWS CLI command for each Security Group ID to disable CloudWatch audit logging:
     aws mq update-broker --broker-id <BROKER_ID> --logging { "audit": false }
     
   Replace <BROKER_ID> with the actual ID of the MQ Broker associated with the Security Group.
3. Verify the changes:
   • Run the following AWS CLI command to describe the MQ Broker and verify that CloudWatch audit logging is disabled for the Security Group:
     aws mq describe-broker --broker-id <BROKER_ID>
     
   Replace <BROKER_ID> with the actual ID of the MQ Broker associated with the Security Group.
4. Repeat for other Security Groups:
   • If there are multiple Security Groups associated with the MQ Brokers, repeat steps 2 and 3 for each Security Group.

1. Identify the Security Groups: First, you need to identify the Security Groups associated with your MQ Brokers.
2. Disable CloudWatch Audit Logging: You can use the AWS SDK for Python (Boto3) to disable CloudWatch audit logging for the identified Security Groups. Here is a sample Python code snippet to achieve this:

import boto3

# Initialize the AWS clients
ec2_client = boto3.client('ec2')

# Specify the Security Group IDs of the MQ Brokers
security_group_ids = ['sg-12345678', 'sg-87654321']

# Disable CloudWatch Audit Logging for each Security Group
for sg_id in security_group_ids:
    response = ec2_client.modify_flow_logs(
        DeliverLogsPermissionArn='',
        LogGroupName='',
        ResourceIds=[sg_id],
        ResourceType='VPC',
        TrafficType='ALL',
        LogDestinationType='cloud-watch-logs',
        LogDestination=''
    )
    print(f"CloudWatch Audit Logging disabled for Security Group {sg_id}")

3. Run the Python Script: Save the above Python script in a file (e.g., remediate_security_groups.py) and execute it using Python. Make sure you have the necessary IAM permissions to modify the Security Groups.