Description

Detects when AWS Redshift clusters have user activity logging disabled. User activity logging is critical for security auditing and compliance as it tracks user actions within the database cluster. Disabling this logging capability reduces visibility into potential security incidents and user behaviors.

Detection Strategy

• Checks all Redshift clusters in the specified AWS region

• Examines each cluster's parameter groups for the 'enable_user_activity_logging' parameter

• Reports a vulnerability if the parameter value is set to 'false'

• Includes the cluster identifier and parameter details in the vulnerability report