AWS Aurora MySQL DB cluster does not publish audit logs to CloudWatch Logs
This policy identifies AWS Aurora MySQL DB cluster where audit logging is disabled or audit logs are not published to Amazon CloudWatch Logs.

Aurora MySQL DB cluster integrates with Amazon CloudWatch for performance metric gathering and analysis, supporting CloudWatch Alarms. While the Aurora MySQL DB cluster provides customizable audit logs for monitoring database operations, these logs are not automatically sent to CloudWatch Logs, limiting centralized monitoring and analysis of database activities.

It is recommended to configure the Aurora MySQL DB cluster to enable audit logs and publish audit logs to CloudWatch
This is applicable to aws cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: To create a custom parameter group if the cluster has only the default parameter group use the following steps: 

1. Sign in to the AWS Management Console
2. Select the specific region from the region drop-down in the top right corner, for which the alert is generated
3. In the Navigation Panel on the left, Select 'All services' and under 'Database', select 'RDS'
4. In the navigation pane, choose 'Parameter groups'
5. Choose 'Create parameter group'
6. The Create parameter group window appears

  6a. In the 'Parameter group name' box, enter the name of the new DB cluster parameter group.
  6b. In the 'Description' box, enter a description for the new DB cluster parameter group.
  6c. In the 'Engine type' drop-down, select the engine type (Aurora MySQL)
  6d. In the 'Parameter group family' list, select a DB parameter group family
  6e. In the Type list, select 'DB cluster Parameter Group'.

7. Choose 'Create'

To modify the custom DB cluster parameter group to enable audit logging, follow the below steps: 

1. Sign in to the AWS Management Console
2. Select the specific region from the region drop-down in the top right corner, for which the alert is generated
3. In the Navigation Panel on the left, Select 'All services' and under 'Database', select 'RDS'
4. In the navigation pane, choose 'Parameter groups'
5. In the list, choose the above-created parameter group or the reported resource custom parameter group that you want to modify.
6. Choose 'Actions', and then choose 'Edit' to modify your Parameter group.  
7. Change the value of the 'server_audit_logging' parameter to '1' in the value drop-down and click 'Save Changes' for enabling audit logs.

To modify an AWS Aurora MySQL DB Cluster to use the custom parameter group, follow the below steps: 

1. Sign in to the AWS Management Console
2. Select the specific region from the region drop-down in the top right corner, for which the alert is generated
3. In the Navigation Panel on the left, Select 'All services' and under 'Database', select 'RDS'
4. In the navigation pane, choose 'Databases'
5. Choose the reported cluster that you want to associate your parameter group with. Choose 'Modify' to modify your cluster 
6. Under 'Additional configuration', select the above-created cluster parameter group from the 'DB cluster parameter group' dropdown
7. Choose 'Continue' and check the summary of modifications
8. Under the 'Schedule modifications' section, select 'Apply during the next scheduled maintenance window' or 'Apply immediately' based on your requirements for when to apply modifications
9. Choose 'Modify cluster' to save your changes

To modify an AWS Aurora MySQL DB Cluster for enabling export logs to cloudwatch, follow the below steps: 

1. Sign in to the AWS Management Console
2. Select the specific region from the region drop-down in the top right corner, for which the alert is generated
3. In the Navigation Panel on the left, Select 'All services' and under 'Database', select 'RDS'
4. In the navigation pane, choose 'Databases'
5. Choose the reported cluster that you want to associate your parameter group with. Choose 'Modify' to modify your cluster
6. In the 'Log exports' section, choose the 'Audit log' to start publishing to CloudWatch Logs
7. Choose 'Continue' and check the summary of modifications
8. Under the 'Schedule modifications' section, select 'Apply during the next scheduled maintenance window' or 'Apply immediately' based on your requirements for when to apply modifications
9. Choose 'Modify cluster' to save your changes.

Query:
```config from cloud.resource where api.name = 'aws-rds-db-cluster' AND json.rule = engine equals "aurora-mysql" and status equals "available" as X; config from cloud.resource where api.name = 'aws-rds-db-cluster-parameter-group' AND json.rule = DBParameterGroupFamily contains "aurora-mysql" as Y; filter '$.X.dBclusterParameterGroupArn equals $.Y.DBClusterParameterGroupArn and (($.Y.parameters.server_audit_logging.ParameterValue does not exist or $.Y.parameters.server_audit_logging.ParameterValue equals 0) or ($.X.enabledCloudwatchLogsExports does not contain "audit" and $.Y.parameters.server_audit_logs_upload.ParameterValue equals 0))' ; show X;```