AWS Neptune DB cluster does not publish audit logs to CloudWatch Logs
This policy identifies Amazon Neptune DB clusters where audit logging is disabled or audit logs are not published to Amazon CloudWatch Logs.

Neptune DB integrates with Amazon CloudWatch for performance metric gathering and analysis, supporting CloudWatch Alarms. While Neptune DB provides customizable audit logs for monitoring database operations, these logs are not automatically sent to CloudWatch Logs, limiting centralized monitoring and analysis of database activities.

It is recommended to configure the Neptune DB cluster to enable audit logs and publish audit logs to CloudWatch logs.
This is applicable to aws cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: To create a custom parameter group if the cluster has only the default parameter group use the following steps: 

1. Sign in to the AWS Management Console and open the Amazon Neptune DB console. 
2. In the navigation pane, choose 'Parameter groups'. 
3. Choose 'Create'. The 'Create cluster parameter group' window appears. 
4. In the 'Parameter group family' list, select a 'DB parameter group family'.
5. In the 'Parameter group type', Select 'DB cluster parameter group'.
6. In the 'New cluster parameter group name', enter the name of the new DB cluster parameter group. 
7. In the Description box, enter a description for the new DB cluster parameter group. 
8. Click 'Create'. 

To modify the custom DB cluster parameter group to enable query logging, follow the below steps: 

1. Sign in to the AWS Management Console and open the Amazon Neptune DB console. 
2. In the navigation pane, choose 'Parameter groups'. 
3. In the list, choose the above-created parameter group or the reported resource custom parameter group that you want to modify. 
4. Change the value of the 'neptune_enable_audit_log' parameter to '1' in the value drop-down and click on tick mark for enabling audit logs.

To modify an Amazon Neptune DB Cluster to use the custom parameter group, follow the below steps: 

1. Sign in to the AWS Management Console and open the Amazon Neptune DB console. 
2. In the navigation pane, choose 'Databases', and then choose the 'DB instance' that you want to modify. 
3. Choose the reported cluster that you want to associate your parameter group with. Choose 'Actions', and then choose 'Modify' to modify your cluster. 
4. Under 'Additional settings', select the above-created cluster parameter group from the DB parameter group dropdown. 
5. Choose 'Continue' and check the summary of modifications. 
6. On the confirmation page, review your changes. If they are correct, choose 'Modify cluster' to save your changes. 

To modify an Amazon Neptune DB cluster for enabling export logs to cloudwatch, follow the below steps: 

1. Sign in to the AWS Management Console and open the Amazon Neptune DB console. 
2. In the navigation pane, choose 'Databases', and then choose the 'DB instance' that you want to modify. 
3. Choose the reported cluster that you want to associate your parameter group with. Choose 'Actions', and then choose 'Modify' to modify your cluster.
4. Scroll down to the Log exports section, and choose 'Enable' for the 'Audit logs'.
5. Choose 'Continue'.
6. Choose 'Modify cluster'..

Query:
```config from cloud.resource where api.name = 'aws-neptune-db-cluster' AND json.rule = Status equals "available" as X; config from cloud.resource where api.name = 'aws-neptune-db-cluster-parameter-group' AND json.rule = parameters.neptune_enable_audit_log.ParameterValue exists and parameters.neptune_enable_audit_log.ParameterValue equals 0 as Y; filter '($.X.EnabledCloudwatchLogsExports.member does not contain "audit") or $.X.DBClusterParameterGroup equals $.Y.DBClusterParameterGroupName' ; show X;```