Copy page

User Guides

AWS Redshift Audit Visibility

This guide walks through enabling database audit logging on Amazon Redshift and routing those logs to either CloudWatch or Amazon S3, where Monad can ingest them. For CloudWatch, use the AWS CloudWatch Logs input; for S3, use the Redshift Audit Logs input.

Sync Type: Incremental

---

How Redshift Delivers Audit Logs

Amazon Redshift records database activity in three audit log types, and can deliver them to two destinations.

Log Types

Log Type	Description
Connection log	Authentication attempts, connections, and disconnections.
User log	Changes to database user definitions (create, drop, rename, alter).
User activity log	Each query run against the database. Requires the enable_user_activity_logging parameter to be true.

Destinations

Destination	Description
CloudWatch	Audit log entries streamed to CloudWatch log groups, queryable via standard CloudWatch APIs.
Amazon S3	Audit log files delivered as gzip-compressed objects to an S3 bucket.

You can route to one or both destinations. Choose based on which Monad input you want to use:

• CloudWatch → AWS CloudWatch Logs input.
• S3 → Redshift Audit Logs input.

---

Step 1 — Enable the User Activity Log Parameter (optional)

The connection log and user log require no parameter changes. Skip this step unless you want the user activity log.

The user activity log is gated behind a cluster parameter:

1. Open the Amazon Redshift Console
2. In the left navigation pane, choose Configurations → Workload management (or Parameter groups)
3. Select the parameter group attached to your cluster, or Create parameter group and attach it later
4. Set enable_user_activity_logging param's value to true
5. Save changes. If you created a new parameter group, attach it to the cluster (Clusters → your cluster → Actions → Modify → Database configurations → Parameter group) and reboot the cluster to apply.

---

Step 2 — Turn On Audit Logging and Choose a Destination

1. Open the Amazon Redshift Console
2. In the left navigation pane, choose Clusters and select your cluster
3. Choose Properties
4. Under Database configurations, find Audit logging and choose Edit
5. Toggle Configure audit logging to on
6. Under Log export type, choose your destination:
   • CloudWatch — see Step 3A
   • S3 — see Step 3B
7. Select the log types you want to export: Connection log, User log, and/or User activity log

---

Step 3A — Route to CloudWatch

1. In the Edit audit logging dialog, set Log export type to CloudWatch
2. Select the log types to export
3. Choose Save changes

AWS automatically creates a CloudWatch log group per log type once the export is enabled.

CloudWatch Log Group Naming

Redshift publishes each log type to its own log group under the following convention:

Code
/aws/redshift/cluster/<cluster-name>/<log-type>

Where <log-type> is one of connectionlog, userlog, or useractivitylog. For example:

Log Type	CloudWatch Log Group
Connection log	/aws/redshift/cluster/<cluster-name>/connectionlog
User log	/aws/redshift/cluster/<cluster-name>/userlog
User activity log	/aws/redshift/cluster/<cluster-name>/useractivitylog

You will use this log group name (or the /aws/redshift/cluster/<cluster-name>/ prefix) when configuring the CloudWatch Logs input in Step 5.

---

Step 3B — Route to S3

1. In the Edit audit logging dialog, set Log export type to S3
2. Choose an existing bucket or create a new one, and optionally specify an S3 key prefix
3. Select the log types to export
4. Choose Save changes

If you use an existing bucket, attach a bucket policy that allows the Redshift service principal to write logs:

Code
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "RedshiftAuditLoggingPut",
      "Effect": "Allow",
      "Principal": { "Service": "redshift.amazonaws.com" },
      "Action": ["s3:PutObject", "s3:GetBucketAcl"],
      "Resource": [
        "arn:aws:s3:::{bucket-name}",
        "arn:aws:s3:::{bucket-name}/*"
      ]
    }
  ]
}

S3 Bucket Naming Convention

Redshift organizes audit log objects within the bucket using the following key structure:

Code
AWSLogs/{AccountID}/redshift/{Region}/{Year}/{Month}/{Day}/{AccountID}_redshift_{Region}_{ClusterName}_{LogType}_{Timestamp}.gz

For example:

Code
AWSLogs/123456789012/redshift/us-east-1/2024/01/15/123456789012_redshift_us-east-1_mycluster_connectionlog_2024-01-15T18:01.gz

If you specified a custom key prefix when enabling audit logging, it is prepended to the path:

Code
{your-prefix}/AWSLogs/123456789012/redshift/us-east-1/...

Limitation: Monad's Redshift Audit Logs input for S3 supports the Connection log and User log types only. The User activity log type is not supported via this input. If you need to ingest the user activity log, route it to CloudWatch and use the AWS CloudWatch Logs input instead.

---

Step 4 — Grant IAM Permissions

The IAM role or user used by Monad needs read access to the destination you chose.

For CloudWatch

Code
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CloudWatchDiscoverLogGroups",
      "Effect": "Allow",
      "Action": "logs:DescribeLogGroups",
      "Resource": "*"
    },
    {
      "Sid": "CloudWatchReadAuditEvents",
      "Effect": "Allow",
      "Action": "logs:FilterLogEvents",
      "Resource": "arn:aws:logs:<region>:<account-id>:log-group:/aws/redshift/cluster/<cluster-name>/*:*"
    }
  ]
}

For S3

Code
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "RedshiftAuditLogsList",
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::{bucket-name}"
    },
    {
      "Sid": "RedshiftAuditLogsRead",
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::{bucket-name}/*"
    }
  ]
}

Attach the policy to either an IAM role (for Role ARN authentication, recommended) or an IAM user (for static credentials). See AWS Authentication Methods for configuring the trust relationship.

---

Step 5 — Connect Monad

CloudWatch

Configure the AWS CloudWatch Logs input with:

• Region: the AWS region where your Redshift cluster is deployed
• Role ARN (or Access Key / Secret Key): the credentials from Step 4
• Log Group Name Prefix: /aws/redshift/cluster/<cluster-name>/ to ingest all log types, or a specific log group such as /aws/redshift/cluster/<cluster-name>/connectionlog

S3

Configure the Redshift Audit Logs input with:

• Bucket: the bucket receiving the audit logs
• Log Type: Connection Log or User Log
• Prefix: the path up to the region, e.g. AWSLogs/<account-id>/redshift/<region>. Include your custom key prefix in front if you set one.
• Region: the region of the S3 bucket (auto-detected if left blank)
• Role ARN (or Access Key / Secret Key): the credentials from Step 4
• Backfill Start Time (optional): an ISO 8601 date to start ingesting historical logs from

To ingest both the connection log and user log from S3, create one Redshift Audit Logs input per log type.

Related Articles

• Amazon Redshift Database Audit Logging
• Enabling Redshift audit logging
• Redshift audit logging to CloudWatch
• STL_CONNECTION_LOG
• STL_USERLOG