# AWS Redshift Audit Visibility This guide walks through enabling database audit logging on Amazon Redshift and routing those logs to either **CloudWatch** or **Amazon S3**, where Monad can ingest them. For CloudWatch, use the [AWS CloudWatch Logs](../inputs/aws/aws-cloudwatch-logs.mdx) input; for S3, use the [Redshift Audit Logs](../inputs/aws/aws-redshift-audit-logs.mdx) input. **Sync Type: Incremental** --- ## How Redshift Delivers Audit Logs Amazon Redshift records database activity in three audit log types, and can deliver them to two destinations. ### Log Types | Log Type | Description | |---|---| | **Connection log** | Authentication attempts, connections, and disconnections. | | **User log** | Changes to database user definitions (create, drop, rename, alter). | | **User activity log** | Each query run against the database. Requires the `enable_user_activity_logging` parameter to be `true`. | ### Destinations | Destination | Description | |---|---| | **CloudWatch** | Audit log entries streamed to CloudWatch log groups, queryable via standard CloudWatch APIs. | | **Amazon S3** | Audit log files delivered as gzip-compressed objects to an S3 bucket. | You can route to one or both destinations. Choose based on which Monad input you want to use: - **CloudWatch** → [AWS CloudWatch Logs](../inputs/aws/aws-cloudwatch-logs.mdx) input. - **S3** → [Redshift Audit Logs](../inputs/aws/aws-redshift-audit-logs.mdx) input. :::warning Audit logging is **not** enabled by default on Redshift. The connection log and user log are produced once audit logging is on; the user activity log additionally requires the `enable_user_activity_logging` parameter to be enabled (see Step 1). ::: --- ## Step 1 — Enable the User Activity Log Parameter (optional) The connection log and user log require no parameter changes. **Skip this step** unless you want the user activity log. The user activity log is gated behind a cluster parameter: 1. Open the [Amazon Redshift Console](https://console.aws.amazon.com/redshiftv2) 2. In the left navigation pane, choose **Configurations → Workload management** (or **Parameter groups**) 3. Select the parameter group attached to your cluster, or **Create parameter group** and attach it later 4. Set `enable_user_activity_logging` param's value to `true` 5. Save changes. If you created a new parameter group, attach it to the cluster (**Clusters → your cluster → Actions → Modify → Database configurations → Parameter group**) and reboot the cluster to apply. --- ## Step 2 — Turn On Audit Logging and Choose a Destination 1. Open the [Amazon Redshift Console](https://console.aws.amazon.com/redshiftv2) 2. In the left navigation pane, choose **Clusters** and select your cluster 3. Choose **Properties** 4. Under **Database configurations**, find **Audit logging** and choose **Edit** 5. Toggle **Configure audit logging** to **on** 6. Under **Log export type**, choose your destination: - **CloudWatch** — see [Step 3A](#step-3a--route-to-cloudwatch) - **S3** — see [Step 3B](#step-3b--route-to-s3) 7. Select the log types you want to export: **Connection log**, **User log**, and/or **User activity log** --- ## Step 3A — Route to CloudWatch 1. In the **Edit audit logging** dialog, set **Log export type** to **CloudWatch** 2. Select the log types to export 3. Choose **Save changes** AWS automatically creates a CloudWatch log group per log type once the export is enabled. ### CloudWatch Log Group Naming Redshift publishes each log type to its own log group under the following convention: ``` /aws/redshift/cluster// ``` Where `` is one of `connectionlog`, `userlog`, or `useractivitylog`. For example: | Log Type | CloudWatch Log Group | |---|---| | Connection log | `/aws/redshift/cluster//connectionlog` | | User log | `/aws/redshift/cluster//userlog` | | User activity log | `/aws/redshift/cluster//useractivitylog` | You will use this log group name (or the `/aws/redshift/cluster//` prefix) when configuring the CloudWatch Logs input in [Step 5](#step-5--connect-monad). --- ## Step 3B — Route to S3 1. In the **Edit audit logging** dialog, set **Log export type** to **S3** 2. Choose an existing bucket or create a new one, and optionally specify an S3 key prefix 3. Select the log types to export 4. Choose **Save changes** If you use an existing bucket, attach a bucket policy that allows the Redshift service principal to write logs: ```json { "Version": "2012-10-17", "Statement": [ { "Sid": "RedshiftAuditLoggingPut", "Effect": "Allow", "Principal": { "Service": "redshift.amazonaws.com" }, "Action": ["s3:PutObject", "s3:GetBucketAcl"], "Resource": [ "arn:aws:s3:::{bucket-name}", "arn:aws:s3:::{bucket-name}/*" ] } ] } ``` ### S3 Bucket Naming Convention Redshift organizes audit log objects within the bucket using the following key structure: ``` AWSLogs/{AccountID}/redshift/{Region}/{Year}/{Month}/{Day}/{AccountID}_redshift_{Region}_{ClusterName}_{LogType}_{Timestamp}.gz ``` For example: ``` AWSLogs/123456789012/redshift/us-east-1/2024/01/15/123456789012_redshift_us-east-1_mycluster_connectionlog_2024-01-15T18:01.gz ``` If you specified a custom key prefix when enabling audit logging, it is prepended to the path: ``` {your-prefix}/AWSLogs/123456789012/redshift/us-east-1/... ``` > **Limitation:** Monad's [Redshift Audit Logs](../inputs/aws/aws-redshift-audit-logs.mdx) input for S3 supports the **Connection log** and **User log** types only. The **User activity log** type is not supported via this input. If you need to ingest the user activity log, route it to CloudWatch and use the [AWS CloudWatch Logs](../inputs/aws/aws-cloudwatch-logs.mdx) input instead. --- ## Step 4 — Grant IAM Permissions The IAM role or user used by Monad needs read access to the destination you chose. ### For CloudWatch ```json { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudWatchDiscoverLogGroups", "Effect": "Allow", "Action": "logs:DescribeLogGroups", "Resource": "*" }, { "Sid": "CloudWatchReadAuditEvents", "Effect": "Allow", "Action": "logs:FilterLogEvents", "Resource": "arn:aws:logs:::log-group:/aws/redshift/cluster//*:*" } ] } ``` ### For S3 ```json { "Version": "2012-10-17", "Statement": [ { "Sid": "RedshiftAuditLogsList", "Effect": "Allow", "Action": "s3:ListBucket", "Resource": "arn:aws:s3:::{bucket-name}" }, { "Sid": "RedshiftAuditLogsRead", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::{bucket-name}/*" } ] } ``` Attach the policy to either an IAM role (for Role ARN authentication, recommended) or an IAM user (for static credentials). See [AWS Authentication Methods](../inputs/aws/index.mdx#authentication-methods) for configuring the trust relationship. --- ## Step 5 — Connect Monad ### CloudWatch Configure the [AWS CloudWatch Logs](../inputs/aws/aws-cloudwatch-logs.mdx) input with: - **Region:** the AWS region where your Redshift cluster is deployed - **Role ARN** (or **Access Key** / **Secret Key**): the credentials from Step 4 - **Log Group Name Prefix:** `/aws/redshift/cluster//` to ingest all log types, or a specific log group such as `/aws/redshift/cluster//connectionlog` ### S3 Configure the [Redshift Audit Logs](../inputs/aws/aws-redshift-audit-logs.mdx) input with: - **Bucket:** the bucket receiving the audit logs - **Log Type:** **Connection Log** or **User Log** - **Prefix:** the path up to the region, e.g. `AWSLogs//redshift/`. Include your custom key prefix in front if you set one. - **Region:** the region of the S3 bucket (auto-detected if left blank) - **Role ARN** (or **Access Key** / **Secret Key**): the credentials from Step 4 - **Backfill Start Time** (optional): an ISO 8601 date to start ingesting historical logs from To ingest both the connection log and user log from S3, create one Redshift Audit Logs input per log type. ## Related Articles - [Amazon Redshift Database Audit Logging](https://docs.aws.amazon.com/redshift/latest/mgmt/db-auditing.html) - [Enabling Redshift audit logging](https://docs.aws.amazon.com/redshift/latest/mgmt/db-auditing-console.html) - [Redshift audit logging to CloudWatch](https://docs.aws.amazon.com/redshift/latest/mgmt/db-auditing.html#db-auditing-cloudwatch-provisioned) - [STL_CONNECTION_LOG](https://docs.aws.amazon.com/redshift/latest/dg/r_STL_CONNECTION_LOG.html) - [STL_USERLOG](https://docs.aws.amazon.com/redshift/latest/dg/r_STL_USERLOG.html)