NIST SP 800-53 Rev. 5 · Audit and Accountability
AU-12 on AWS
Required audit logging not enabled — a published SQL (Athena) + Lambda query you can run against Amazon Athena over Config inventory + supplied asset inventory, with the evidence it needs, the settings you decide, and what a result does and does not establish.
Why this matters
A system that is supposed to be recording events and is silently recording nothing
Organizations decide which systems must keep an event record, and then assume the arrangement holds. Recording breaks quietly: an agent stops running, a setting is lost during a rebuild, a new system is created without it. Nothing raises an alarm, because the absence of records looks identical to the absence of activity.
Why this check earns its place. Silence is the hardest failure to notice, because there is nothing to see. This check compares what should be reporting against what actually is, which is the only way the gap becomes visible.
- What it reads
- The organization's own list of systems that must keep records, compared against what is actually arriving.
- What it reports
- Systems declared as requiring an event record that have produced none during the period examined.
See related public disclosures on the Signals page →
What this finds
Asset declared as requiring audit logging is producing no observed telemetry in the observation window.
The requirement
The organization must provide audit record generation capability for the event types the system is capable of auditing, on all components that require auditing.
NIST SP 800-53 Rev. 5 — AU-12 (Audit Record Generation).
NIST requires audit generation on components that require auditing. Which components those are is an organizational decision, supplied here through the asset inventory's logging_required flag. The platform cannot infer it.
How this maps to the CISA performance goals
The Cross-Sector Cybersecurity Performance Goals are a voluntary baseline published by CISA — the U.S. federal agency for critical-infrastructure cybersecurity — written for organizations too small to employ security staff. This control speaks to:
- 3.Q — Maintain log collection & storage
The goal requires the relevant logs to exist; the pack finds required logging not enabled. - 4.B — Identify adverse events
Adverse events cannot be identified from telemetry that was never recorded.
See the full coverage map, including the goals no query can answer →
Evidence this query needs
Asset inventory asset_inventory.csv
Declares which assets are in scope and what is required of them. A backup that never ran on an asset you did not know existed produces no alert — absence of evidence is invisible without an inventory to compare against.
Minimum fields: asset_id, environment, criticality
Three fields let you scope the checks. The backup_required and logging_required flags are what make the absence checks possible — without them the tool cannot tell an asset that should be backed up from one that should not.
The query
Published as au-12-logging-coverage.aws.sql. Reads asset_inventory (supplied), cloudtrail_logs. Requires: athena:StartQueryExecution; config:SelectAggregateResourceConfig.
Before this returns anything,
cloudtrail_logs has to be reaching Amazon Athena over Config inventory + supplied asset inventory, and asset_inventory (supplied) has to be landed there. If not, the query reports nothing found — which looks
exactly like nothing wrong. What has to be switched on first →
-- AU-12 -- in-scope assets with no observed audit telemetry
WITH observed AS (
SELECT DISTINCT lower(element_at(resources, 1).arn) AS asset_key
FROM cloudtrail_logs
WHERE from_iso8601_timestamp(eventtime)
> current_timestamp - interval '3' day
AND cardinality(resources) > 0
)
SELECT
a.asset_id, a.asset_name, a.environment,
a.criticality, a.owner,
'AWS Config' AS source_system
FROM asset_inventory a
LEFT JOIN observed o
ON lower(a.asset_id) = o.asset_key
WHERE a.logging_required = true
AND o.asset_key IS NULL
AND (a.decommission_date IS NULL OR a.decommission_date > current_date)
ORDER BY
CASE a.criticality
WHEN 'critical' THEN 1 WHEN 'high' THEN 2
WHEN 'medium' THEN 3 ELSE 4 END;Open this pack on AWS to adjust the settings and download it →
The interactive version opens on AWS — the platform on this page — even if your environment profile does not list it.
Settings you decide
NIST states the objective and leaves these to your organization. The interactive version of this pack applies them to the query for you.
- Observation window (days) (default 3)
- An in-scope asset producing no telemetry across this window is reported.
- Limit to specific assets (optional)
- Paste asset identifiers, one per line.
Running it continuously
EventBridge Scheduler → Lambda → Security Hub
Schedule: EventBridge Scheduler, rate(1 day)
Compute: Lambda (Python 3.12), 180s timeout
Step 1: Query observed telemetry over the window
Step 2: Left-join the supplied asset inventory
Step 3: Exclude decommissioned assets
Step 4: BatchImportFindings -> Security Hub
Severity label: HIGH
RelatedRequirements: NIST.800-53.r5 AU-12
Idempotency: Id = sha256(asset_id + "no-audit-telemetry")Ordering by criticality means the finding queue is already triaged when the analyst opens it — a small thing that matters when the inventory is large.
What a result does not prove
Absence of telemetry may reflect an inventory error, a routing change, or a genuinely idle asset rather than disabled logging. This check identifies where audit coverage cannot be evidenced — not where it definitively fails.
Validation status for this platform: Not tenant-validated. Structure, query generation, and preflight are covered by the project's automated test suites. This pack has not been executed against a live tenant, account, or index. Validate it in a non-production scope before relying on any result.
Before you act on a result
- Is the asset genuinely in scope, or is the inventory flag wrong?
- Was the asset created inside the grace period?
- Is telemetry flowing to a destination this query does not read?
- Has the asset been decommissioned without the inventory being updated?
Common questions
- How do I check for required audit logging not enabled in AWS?
- Run the published SQL (Athena) + Lambda query on this page against Amazon Athena over Config inventory + supplied asset inventory. It reads asset_inventory (supplied), cloudtrail_logs and reports: Asset declared as requiring audit logging is producing no observed telemetry in the observation window.
- What permissions are needed to run this AWS query?
- athena:StartQueryExecution; config:SelectAggregateResourceConfig.
- What evidence does AU-12 need that AWS cannot produce?
- Asset inventory (asset_inventory.csv). Declares which assets are in scope and what is required of them. A backup that never ran on an asset you did not know existed produces no alert — absence of evidence is invisible without an inventory to compare against. At minimum it must carry: asset_id, environment, criticality.
- Does a result from this query mean the control has failed?
- Absence of telemetry may reflect an inventory error, a routing change, or a genuinely idle asset rather than disabled logging. This check identifies where audit coverage cannot be evidenced — not where it definitively fails.
Terms used on this page
- NIST SP 800-53the U.S. federal catalogue of security requirements
- The catalogue of security and privacy requirements published by the National Institute of Standards and Technology, a U.S. federal agency. U.S. government systems are measured against it, and many private organizations adopt it voluntarily. Each requirement has an identifier such as AC-2. Official source →
- CISACybersecurity and Infrastructure Security Agency
- The U.S. federal agency responsible for national critical-infrastructure cybersecurity. Its publications are works of the U.S. government and are free to use. Official source →
- CPGCross-Sector Cybersecurity Performance Goals
- A voluntary baseline of security practices published by the U.S. Cybersecurity and Infrastructure Security Agency, written specifically for organizations too small to employ security staff. It is a short, plainly written starting list rather than a full standard. Official source →
- not tenant-validatednever executed against real data
- The check has passed the project's automated tests for structure and syntax, but has never been run against real data anywhere. Test it in a safe scope before relying on any result.