aws-documentdb-profiler-audit-log-destination
Profiler and audit logs may record command text, namespaces, user names, and application-supplied query values.
Where it sits
| location | CloudWatch Logs event.message for DocumentDB profiler/audit logs |
|---|---|
| location kind | log_field |
| data kinds | credential sensitive_data pii |
| emits edge | ContainsSecret |
| service | DocumentDB (aws:documentdb) |
Collection recipe
| access mode | indirect_destination |
|---|---|
| operation | logs:FilterLogEvents |
| response path | Events[].Message |
| encoding | string |
| params | {"LogGroupName": "\u003cdocumentdb-log-group\u003e"} |
Required permissions
logs:FilterLogEvents