Missing audit and/or profiler exports reduces observability of authentication, authorization, and data definition activity. Attacks like brute-force logins, privilege abuse, or destructive schema changes can go unnoticed, degrading confidentiality and integrity and delaying incident response.

Enable export of both audit and profiler logs to CloudWatch Logs for all clusters and centralize analysis. Apply least privilege to log access, define retention and immutability, integrate with alerting, and use separation of duties to protect and regularly review logs for defense in depth.

• https://docs.aws.amazon.com/securityhub/latest/userguide/documentdb-controls.html#documentdb-4
• https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/DocumentDB/enable-profiler.html
• https://docs.aws.amazon.com/cli/latest/reference/docdb/create-db-cluster.html