Managing audit logs
Amazon Redshift allows you to log user activity, connections, and database operations by using audit logs. Audit logs are published asynchronously into Amazon S3 or to AWS CloudWatch. These logs are a way to monitor the requests to your clusters, which can be used for implementing security requirements and for troubleshooting purposes. For example, let’s say that you want to find the user who might have truncated a particular table on a particular day in the past. Audit logs can uncover this information. Amazon Redshift provisioned clusters can be configured to send audit logs to either Amazon S3 or AWS CloudWatch (https://docs.aws.amazon.com/redshift/latest/mgmt/db-auditing.html#db-auditing-cloudwatch-provisioned). For Amazon Redshift serverless endpoints, audit logs can be sent to Amazon CloudWatch. (https://docs.aws.amazon.com/redshift/latest/mgmt/serverless-audit-logging.html).
Getting ready
To complete this recipe, you will need the following...