Project: KICS (Provisioning / Security & Compliance)
File: e519ed6a-8328-4b69-8eb7-8fa549ac3050.md

title: MQ Broker Logging Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: e519ed6a-8328-4b69-8eb7-8fa549ac3050 Query name: MQ Broker Logging Disabled Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Observability URL: Check if MQ Brokers don't have logging enabled in any of the two options possible (audit and general).<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="42 84 22 88 63" AWSTemplateFormatVersion: "2010-09-09" Description: "Create a basic ActiveMQ broker" Resources: BasicBroker3: Type: "AWS::AmazonMQ::Broker" Properties: BrokerName: MyBasicBroker DeploymentMode: SINGLE_INSTANCE EngineType: ActiveMQ EngineVersion: "5.15.0" HostInstanceType: mq.t2.micro PubliclyAccessible: false Users: ConsoleAccess: "true" Groups: MyGroup Password: Ref: "BrokerPassword" Username: Ref: "BrokerUsername" Logs: General: true BasicBroker4: Type: "AWS::AmazonMQ::Broker" Properties: BrokerName: MyBasicBroker DeploymentMode: SINGLE_INSTANCE EngineType: ActiveMQ EngineVersion: "5.15.0" HostInstanceType: mq.t2.micro PubliclyAccessible: false Users: ConsoleAccess: "true" Groups: MyGroup Password: Ref: "BrokerPassword" Username: Ref: "BrokerUsername" Logs: Audit: true BasicBroker5: Type: "AWS::AmazonMQ::Broker" Properties: BrokerName: MyBasicBroker DeploymentMode: SINGLE_INSTANCE EngineType: ActiveMQ EngineVersion: "5.15.0" HostInstanceType: mq.t2.micro PubliclyAccessible: false Users: ConsoleAccess: "true" Groups: MyGroup Password: Ref: "BrokerPassword" Username: Ref: "BrokerUsername" Logs: General: false Audit: true BasicBroker6: Type: "AWS::AmazonMQ::Broker" Properties: BrokerName: MyBasicBroker DeploymentMode: SINGLE_INSTANCE EngineType: ActiveMQ EngineVersion: "5.15.0" HostInstanceType: mq.t2.micro PubliclyAccessible: false Users: ConsoleAccess: "true" Groups: MyGroup Password: Ref: "BrokerPassword" Username: Ref: "BrokerUsername" Logs: Audit: false General: true BasicBroker7: Type: "AWS::AmazonMQ::Broker" Properties: BrokerName: MyBasicBroker DeploymentMode: SINGLE_INSTANCE EngineType: ActiveMQ EngineVersion: "5.15.0" HostInstanceType: mq.t2.micro PubliclyAccessible: false Users: ConsoleAccess: "true" Groups: MyGroup Password: Ref: "BrokerPassword" Username: Ref: "BrokerUsername" ``` ```json title="Positive test num. 2 - json file" hl_lines="115 85 56 121 28" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "Create a basic ActiveMQ broker", "Resources": { "BasicBroker8": { "Type": "AWS::AmazonMQ::Broker", "Properties": { "BrokerName": "MyBasicBroker", "DeploymentMode": "SINGLE_INSTANCE", "EngineType": "ActiveMQ", "EngineVersion": "5.15.0", "HostInstanceType":

"Users": [ { "ConsoleAccess": "true", "Groups": [ "MyGroup" ], "Password": { "Ref": "BrokerPassword" }, "Username": { "Ref": "BrokerUsername" } } ], "PubliclyAccessible": false, "Logs": { "General": true } } }, "BasicBroker9": { "Type": "AWS::AmazonMQ::Broker", "Properties": { "BrokerName": "MyBasicBroker", "DeploymentMode": "SINGLE_INSTANCE", "EngineType": "ActiveMQ", "EngineVersion": "5.15.0", "HostInstanceType": "mq.t2.micro", "Users": [ { "ConsoleAccess": "true", "Groups": [ "MyGroup" ], "Password": { "Ref": "BrokerPassword" }, "Username": { "Ref": "BrokerUsername" } } ], "PubliclyAccessible": false, "Logs": { "Audit": true } } }, "BasicBroker10": { "Type": "AWS::AmazonMQ::Broker", "Properties": { "BrokerName": "MyBasicBroker", "DeploymentMode": "SINGLE_INSTANCE", "EngineType": "ActiveMQ", "EngineVersion": "5.15.0", "HostInstanceType": "mq.t2.micro", "Users": [ { "ConsoleAccess": "true", "Groups": [ "MyGroup" ], "Password": { "Ref": "BrokerPassword" }, "Username": { "Ref": "BrokerUsername" } } ], "PubliclyAccessible": false, "Logs": { "General": false, "Audit": true } } }, "BasicBroker11": { "Type": "AWS::AmazonMQ::Broker", "Properties": { "BrokerName": "MyBasicBroker", "DeploymentMode": "SINGLE_INSTANCE", "EngineType": "ActiveMQ", "EngineVersion": "5.15.0", "HostInstanceType": "mq.t2.micro", "Users": [ { "ConsoleAccess": "true", "Groups": [ "MyGroup" ], "Password": { "Ref": "BrokerPassword" }, "Username": { "Ref": "BrokerUsername" } } ], "PubliclyAccessible": false, "Logs": { "General": true, "Audit": false } } }, "BasicBroker12": { "Type": "AWS::AmazonMQ::Broker", "Properties": { "BrokerName": "MyBasicBroker", "DeploymentMode": "SINGLE_INSTANCE", "EngineType": "ActiveMQ", "EngineVersion": "5.15.0", "HostInstanceType": "mq.t2.micro", "Users": [ { "ConsoleAccess": "true", "Groups": [ "MyGroup" ], "Password": { "Ref": "BrokerPassword" }, "Username": { "Ref": "BrokerUsername" } } ], "PubliclyAccessible": false } } } } ``` ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: "2010-09-09" Description: "Create a basic ActiveMQ broker" Resources: BasicBroker: Type: "AWS::AmazonMQ::Broker" Properties: AutoMinorVersionUpgrade: "false" BrokerName: MyBasicBroker DeploymentMode: SINGLE_INSTANCE EncryptionOptions: UseAwsOwnedKey: true EngineType: ActiveMQ EngineVersion: "5.15.0" HostInstanceType: mq.t2.micro PubliclyAccessible: false Users: ConsoleAccess: "true" Groups: MyGroup Password: Ref: "BrokerPassword" Username: Ref: "BrokerUsername" Logs: General: true Audit: true ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "Create a basic ActiveMQ broker", "Resources": { "BasicBroker2": { "Type": "AWS::AmazonMQ::Broker", "Properties": { "BrokerName": "MyBasicBroker", "DeploymentMode": "SINGLE_INSTANCE", "EncryptionOptions": { "UseAwsOwnedKey": true }, "EngineType": "ActiveMQ", "EngineVersion": "5.15.0", "HostInstanceType": "mq.t2.micro", "Users": [ { "ConsoleAccess": "true", "Groups": [ "MyGroup" ], "Password": { "Ref": "BrokerPassword" }, "Username": { "Ref": "BrokerUsername" } } ], "AutoMinorVersionUpgrade": "false", "Logs": { "General": true, "Audit": true } } } } } ```