AWS DocumentDB cluster does not publish audit logs to CloudWatch Logs
This policy identifies the Amazon DocumentDB cluster where audit logging is disabled or audit logs are not published to Amazon CloudWatch Logs.

DocumentDB integrates with Amazon CloudWatch for performance metric gathering and analysis, supporting CloudWatch Alarms. While DocumentDB provides customizable audit logs for monitoring database operations, these logs are not automatically sent to CloudWatch Logs, limiting centralized monitoring and analysis of database activities.

It is recommended to configure the DocumentDB cluster to enable audit logs and publish audit logs to CloudWatch logs.
This is applicable to aws cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: To create a custom parameter group if the cluster has only the default parameter group use the following steps: 

1. Sign in to the AWS Management Console and open the Amazon DocumentDB console. 
2. In the navigation pane, choose 'Parameter groups'. 
3. Choose 'Create'. The 'Create cluster parameter group' window appears. 
4. In the 'New cluster parameter group name', enter the name of the new DB cluster parameter group. 
5. In the 'Family' list, select a 'DB parameter group family'. 
6. In the Description box, enter a description for the new DB cluster parameter group. 
7. Click 'Create'. 

To modify the custom DB cluster parameter group to enable query logging, follow the below steps: 

1. Sign in to the AWS Management Console and open the Amazon DocumentDB console. 
2. In the navigation pane, choose 'Parameter groups'. 
3. In the list, choose the above-created parameter group or the reported resource custom parameter group that you want to modify. 
4. Click on the 'audit_logs' parameter and click 'Edit'. 
5. Change the value of the 'audit_logs' parameter to any value (ddl,dml_read,dml_write, all) other than 'disabled' or 'none' you want to modify according to your requirements. 
6. Choose 'Apply immediately' to apply the changes immediately or 'Apply during the next scheduled maintenance window' according to your requirements. 
7. Choose 'Modify cluster parameter' to modify the values. 

To modify an AWS DocumentDB cluster to use the custom parameter group, follow the below steps: 

1. Sign in to the AWS Management Console and open the Amazon DocumentDB console. 
2. In the navigation pane, choose 'Databases', and then choose the 'DB instance' that you want to modify. 
3. Choose the reported cluster that you want to associate your parameter group with. Choose 'Actions', and then choose 'Modify' to modify your cluster. 
4. Scroll down to 'Cluster options', select the above-created cluster parameter group from the DB parameter group dropdown. 
5. Choose 'Continue' and check the summary of modifications. 
6. Choose 'Apply immediately' to apply the changes immediately or 'Apply during the next scheduled maintenance window' according to your requirements. 
7. On the confirmation page, review your changes. If they are correct, choose 'Modify cluster' to save your changes. 

When the value of the audit_logs cluster parameter is enabled, ddl, dml_read, or dml_write, you must also enable Amazon DocumentDB to export logs to Amazon CloudWatch. If you omit either of these steps, audit logs will not be sent to CloudWatch. 

To modify an Amazon DocumentDB cluster for enabling export logs to cloudwatch, follow the below steps: 

1. Sign in to the AWS Management Console and open the Amazon DocumentDB console. 
2. In the navigation pane, choose 'Databases', and then choose the 'DB instance' that you want to modify. 
3. Choose the reported cluster that you want to associate your parameter group with. Choose 'Actions', and then choose 'Modify' to modify your cluster.
4. Scroll down to the Log exports section, and choose 'Enable' for the 'Audit logs'.
5. Choose 'Continue'.
6. Choose 'Apply immediately' to apply the changes immediately or 'Apply during the next scheduled maintenance window' according to your requirements.
7. Choose 'Modify cluster'..

Query:
```config from cloud.resource where api.name = 'aws-docdb-db-cluster' AND json.rule = Status equals "available" as X; config from cloud.resource where api.name = 'aws-docdb-db-cluster-parameter-group' AND json.rule = parameters.audit_logs.ParameterValue is member of ( 'disabled','none') as Y; filter '($.X.EnabledCloudwatchLogsExports.member does not contain "audit") or $.X.DBClusterParameterGroup equals $.Y.DBClusterParameterGroupName' ; show X;```