diff --git a/‎main.tf‎
Lines changed: 6 additions & 0 deletions b/‎main.tf‎
Lines changed: 6 additions & 0 deletions
diff --git a/‎modules/comet_rds/main.tf‎
Lines changed: 56 additions & 1 deletion b/‎modules/comet_rds/main.tf‎
Lines changed: 56 additions & 1 deletion
diff --git a/‎modules/comet_rds/outputs.tf‎
Lines changed: 23 additions & 0 deletions b/‎modules/comet_rds/outputs.tf‎
Lines changed: 23 additions & 0 deletions
diff --git a/‎modules/comet_rds/variables.tf‎
Lines changed: 68 additions & 0 deletions b/‎modules/comet_rds/variables.tf‎
Lines changed: 68 additions & 0 deletions
diff --git a/‎outputs.tf‎
Lines changed: 15 additions & 0 deletions b/‎outputs.tf‎
Lines changed: 15 additions & 0 deletions
diff --git a/‎variables.tf‎
Lines changed: 44 additions & 0 deletions b/‎variables.tf‎
Lines changed: 44 additions & 0 deletions
@@ -440,6 +440,12 @@ module "comet_rds" {
   rds_performance_insights_kms_key_id       = var.rds_performance_insights_kms_key_id
   rds_enhanced_monitoring_interval          = var.rds_enhanced_monitoring_interval
 
+  # CloudWatch Logs export (DND-1537)
+  rds_enabled_cloudwatch_logs_exports = var.rds_enabled_cloudwatch_logs_exports
+  rds_managed_log_group_types         = var.rds_managed_log_group_types
+  rds_log_retention_days              = var.rds_log_retention_days
+  rds_log_kms_key_id                  = var.rds_log_kms_key_id
+
   # Deletion protection
   rds_deletion_protection = var.rds_deletion_protection
 
 
@@ -1,6 +1,11 @@
 locals {
   mysql_port                  = 3306
   enhanced_monitoring_enabled = var.rds_enhanced_monitoring_interval > 0
+
+  # Named once so the CloudWatch log groups can be built from the same identifier the
+  # cluster uses — the group names RDS writes to are /aws/rds/cluster/<id>/<type>, so a
+  # drift between the two would silently leave the real groups unmanaged (DND-1537).
+  rds_cluster_identifier = coalesce(var.rds_cluster_identifier, "cometml-rds-cluster-${var.environment}")
 }
 
 # IAM role for Enhanced Monitoring
@@ -67,8 +72,39 @@ resource "aws_rds_cluster_instance" "comet-ml-rds-mysql" {
   )
 }
 
+# DND-1537: create the log groups ourselves, with retention, so they exist BEFORE the
+# export is switched on below. If RDS gets there first it creates them with no retention
+# ("never expire") and terraform then collides with an unmanaged resource — which is both
+# how the orphaned zoox slowquery group came to bill 3.65 GB indefinitely, and an import
+# nobody wants to do 16 times.
+resource "aws_cloudwatch_log_group" "rds_exported_logs" {
+  # Driven by rds_managed_log_group_types, NOT by the export list — see that variable for
+  # why. Toggling an export off leaves the group in state, so re-enabling it later is a
+  # no-op rather than a ResourceAlreadyExistsException.
+  for_each = toset(var.rds_managed_log_group_types)
+
+  name              = "/aws/rds/cluster/${local.rds_cluster_identifier}/${each.value}"
+  retention_in_days = var.rds_log_retention_days
+  kms_key_id        = var.rds_log_kms_key_id
+
+  # Turning an export off must not delete the evidence already collected — that is the whole
+  # point of exporting. Belt-and-braces now that the two lifecycles are decoupled: it only
+  # bites when a type is removed from rds_managed_log_group_types, which is an explicit
+  # "stop managing this group" rather than a side effect of changing the export list.
+  # The cost is that a real teardown leaves the groups behind, but they carry finite
+  # retention and expire on their own, unlike the never-expire orphan DND-1537 cleaned up.
+  skip_destroy = true
+
+  tags = merge(
+    var.common_tags,
+    {
+      Name = "/aws/rds/cluster/${local.rds_cluster_identifier}/${each.value}"
+    }
+  )
+}
+
 resource "aws_rds_cluster" "cometml-db-cluster" {
-  cluster_identifier                  = coalesce(var.rds_cluster_identifier, "cometml-rds-cluster-${var.environment}")
+  cluster_identifier                  = local.rds_cluster_identifier
   db_subnet_group_name                = aws_db_subnet_group.comet-ml-rds-subnet.name
   availability_zones                  = var.availability_zones
   database_name                       = var.rds_snapshot_identifier == null ? var.rds_database_name : null
@@ -90,6 +126,11 @@ resource "aws_rds_cluster" "cometml-db-cluster" {
   deletion_protection                 = var.rds_deletion_protection
   storage_type                        = var.rds_storage_type
   apply_immediately                   = true
+  enabled_cloudwatch_logs_exports     = var.rds_enabled_cloudwatch_logs_exports
+
+  # The log groups must exist with their retention already set before RDS starts
+  # exporting, otherwise RDS creates them itself at "never expire" (DND-1537).
+  depends_on = [aws_cloudwatch_log_group.rds_exported_logs]
 
   dynamic "serverlessv2_scaling_configuration" {
     for_each = var.rds_serverless_v2_enabled ? [1] : []
@@ -113,6 +154,20 @@ resource "aws_rds_cluster" "cometml-db-cluster" {
     # dependents to "known after apply"). It only matters at destroy time as the
     # snapshot name, so ignore in-place changes and keep the value first stored.
     ignore_changes = [final_snapshot_identifier]
+
+    # Exporting a type that has no managed log group hands group creation back to
+    # RDS, which makes it at never-expire — this module's own failure mode, through
+    # a new door. Both variables default to the same list so this holds out of the
+    # box; the precondition stops someone adding e.g. "general" to the export list
+    # alone. A cross-variable `validation` block would be the natural home, but that
+    # needs Terraform 1.9 and this repo's floor is >= 1.5.7.
+    precondition {
+      condition = alltrue([
+        for t in var.rds_enabled_cloudwatch_logs_exports :
+        contains(var.rds_managed_log_group_types, t)
+      ])
+      error_message = "Every exported log type must also be in rds_managed_log_group_types, or RDS creates its log group at never-expire."
+    }
   }
 }
 
 
@@ -27,3 +27,26 @@ output "mysql_sg_id" {
   description = "Security group ID of the MySQL cluster"
   value       = aws_security_group.mysql_sg.id
 }
+
+# DND-1537: every cluster whose export was enabled out-of-band needs its existing group
+# imported before it can adopt this module, so the import address has to be derivable
+# rather than hand-assembled up to fifteen times.
+#
+# These are the MANAGED groups (rds_managed_log_group_types), deliberately not the exported
+# ones — import needs every group under management, including a `slowquery` group that is
+# still empty because slow_query_log=0. Consumers wiring alarms or metric filters want
+# mysql_exported_log_types below to filter by, or they will alarm on a group nothing writes to.
+output "mysql_log_group_names" {
+  description = "CloudWatch log group names for the RDS log groups this module MANAGES, keyed by log type. Superset of what is actively exported — cross-reference mysql_exported_log_types. Use when adopting a cluster whose export was enabled out-of-band: terraform import 'module.<path>.aws_cloudwatch_log_group.rds_exported_logs[\"error\"]' <name>"
+  value       = { for t, lg in aws_cloudwatch_log_group.rds_exported_logs : t => lg.name }
+}
+
+output "mysql_log_group_arns" {
+  description = "CloudWatch log group ARNs for the RDS log groups this module MANAGES, keyed by log type. Superset of what is actively exported — filter by mysql_exported_log_types before attaching metric filters, subscription filters or alarms, or you will target a group nothing writes to."
+  value       = { for t, lg in aws_cloudwatch_log_group.rds_exported_logs : t => lg.arn }
+}
+
+output "mysql_exported_log_types" {
+  description = "MySQL log types the cluster is actively exporting. Subset of the keys in mysql_log_group_names / mysql_log_group_arns. Note a type can be exported and still produce nothing — 'slowquery' stays empty until slow_query_log=1 is set via rds_cluster_parameters."
+  value       = aws_rds_cluster.cometml-db-cluster.enabled_cloudwatch_logs_exports
+}
@@ -163,6 +163,74 @@ variable "rds_enhanced_monitoring_interval" {
   default     = 60
 }
 
+# DND-1537: without these, no STSaaS cluster exported anything and the MySQL error log
+# was unreadable — agentro is granted rds:DescribeDBLogFiles but not
+# rds:DownloadDBLogFilePortion, so an investigation could see that a log file existed
+# and how large it was, but not a byte of its contents. Exporting to CloudWatch Logs
+# closes that without widening the IAM role.
+variable "rds_enabled_cloudwatch_logs_exports" {
+  description = "MySQL log types the CLUSTER exports to CloudWatch Logs. 'error' carries the entries that matter for post-mortems (CUST-6816). 'slowquery' produces nothing unless slow_query_log=1 is also set via rds_cluster_parameters — it is enabled here so the log group exists and is retention-managed from the moment that parameter is turned on. Pass [] to stop exporting; the log groups themselves are governed separately by rds_managed_log_group_types, so disabling an export never removes a group from state."
+  type        = list(string)
+  default     = ["error", "slowquery"]
+
+  validation {
+    condition     = alltrue([for t in var.rds_enabled_cloudwatch_logs_exports : contains(["audit", "error", "general", "slowquery"], t)])
+    error_message = "Valid Aurora MySQL log types are: audit, error, general, slowquery."
+  }
+}
+
+# Deliberately separate from rds_enabled_cloudwatch_logs_exports: one variable driving both
+# the cluster attribute and the log-group for_each would make disabling an export a one-way
+# door. The group would leave state while surviving in AWS (skip_destroy), and re-enabling
+# the export later would fail on ResourceAlreadyExistsException — the same collision this
+# whole change exists to prevent, just deferred and self-inflicted.
+#
+# Keeping them apart means toggling an export is purely a cluster-attribute change. A type
+# listed here but not exported yields an empty log group with retention already set, which
+# is the desired state for slowquery on the 15 clusters where slow_query_log=0.
+variable "rds_managed_log_group_types" {
+  description = "MySQL log types whose CloudWatch log groups this module creates and manages retention for. Should be a superset of rds_enabled_cloudwatch_logs_exports — a type listed here but not exported simply yields an empty group with retention already applied, ready for when the export (or slow_query_log) is switched on. Removing a type here stops managing its group; it is NOT deleted, because of skip_destroy."
+  type        = list(string)
+  default     = ["error", "slowquery"]
+
+  validation {
+    condition     = alltrue([for t in var.rds_managed_log_group_types : contains(["audit", "error", "general", "slowquery"], t)])
+    error_message = "Valid Aurora MySQL log types are: audit, error, general, slowquery."
+  }
+}
+
+# The cluster and Performance Insights both take a KMS key; the log groups should too.
+# Left at the service-managed key by default (no behaviour change), but exposed now rather
+# than after this reaches 16 clusters — retrofitting it later means touching every env a
+# second time, at exactly the moment DND-1537 flips slow_query_log=1 and the groups start
+# carrying customer SQL text. Also what trivy AVD-AWS-0017 asks for.
+variable "rds_log_kms_key_id" {
+  description = "ARN of a KMS key to encrypt the RDS CloudWatch log groups. Default null uses the CloudWatch service-managed key. Worth setting for environments whose slow query log will carry customer SQL text. When first setting this, the KMS key policy must grant logs.<region>.amazonaws.com permission to use the key, or CreateLogGroup fails with InvalidParameterException — which reads like a terraform problem and is not."
+  type        = string
+  default     = null
+}
+
+# RDS auto-creates /aws/rds/cluster/<id>/<type> with NO retention ("never expire") the
+# instant an export is enabled. That is how the pre-rebuild zoox slowquery group came to
+# hold 3.65 GB of dead data indefinitely (DND-1537). The groups are therefore created
+# explicitly, with retention, and the cluster depends on them so they exist first.
+# 0 ("never expire") is deliberately NOT accepted. It is what RDS applies when it creates
+# these groups itself, and the reason DND-1537 found an orphan holding 3.65 GB of dead data
+# indefinitely — a module whose purpose is to prevent that should not offer it as an option.
+# These groups carry error and slow-query logs, i.e. customer SQL text once slow_query_log
+# is on, so unbounded retention is the wrong default to make reachable. 3653 (10 years) is
+# available if something genuinely needs to keep them a long time.
+variable "rds_log_retention_days" {
+  description = "Retention for the RDS CloudWatch log groups, in days. Must be finite — 'never expire' is not offered, see DND-1537."
+  type        = number
+  default     = 90
+
+  validation {
+    condition     = contains([1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1096, 1827, 2192, 2557, 2922, 3288, 3653], var.rds_log_retention_days)
+    error_message = "Must be a finite retention period CloudWatch Logs accepts (1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1096, 1827, 2192, 2557, 2922, 3288, 3653). 0 / never-expire is intentionally not permitted."
+  }
+}
+
 variable "rds_deletion_protection" {
   description = "Enable deletion protection for RDS cluster"
   type        = bool
 
@@ -53,6 +53,21 @@ output "mysql_database_name" {
   value       = var.enable_rds ? module.comet_rds[0].mysql_database_name : null
 }
 
+output "mysql_log_group_names" {
+  description = "CloudWatch log group names for the RDS log groups this module MANAGES, keyed by log type. Superset of what is actively exported — cross-reference mysql_exported_log_types. Needed to build the terraform import address when adopting a cluster whose export was enabled out-of-band (DND-1537)."
+  value       = var.enable_rds ? module.comet_rds[0].mysql_log_group_names : null
+}
+
+output "mysql_log_group_arns" {
+  description = "CloudWatch log group ARNs for the RDS log groups this module MANAGES, keyed by log type. Superset of what is actively exported — filter by mysql_exported_log_types before attaching metric filters, subscription filters or alarms, or you will target a group nothing writes to."
+  value       = var.enable_rds ? module.comet_rds[0].mysql_log_group_arns : null
+}
+
+output "mysql_exported_log_types" {
+  description = "MySQL log types the cluster is actively exporting. Subset of the keys in mysql_log_group_names / mysql_log_group_arns. A type can be exported and still produce nothing — 'slowquery' stays empty until slow_query_log=1 is set via rds_cluster_parameters."
+  value       = var.enable_rds ? module.comet_rds[0].mysql_exported_log_types : null
+}
+
 output "rds_password_auto_generated" {
   description = "Whether the RDS master password was auto-generated (true) or provided explicitly (false)"
   value       = var.enable_rds ? nonsensitive(var.rds_master_password == null) : null
 
@@ -1168,6 +1168,50 @@ variable "rds_enhanced_monitoring_interval" {
   default     = 60
 }
 
+# DND-1537: a fleet audit found EnabledCloudwatchLogsExports null on all 16 STSaaS Aurora
+# clusters, which left the MySQL error log unreadable during CUST-6816 — agentro holds
+# rds:DescribeDBLogFiles but not rds:DownloadDBLogFilePortion, so the investigation could
+# see a 254 KB error-log spike in the failure hour and could not read it. Exporting to
+# CloudWatch Logs closes that without widening the read-only role.
+variable "rds_enabled_cloudwatch_logs_exports" {
+  description = "MySQL log types the CLUSTER exports to CloudWatch Logs. 'error' carries the entries that matter for post-mortems. 'slowquery' produces nothing unless slow_query_log=1 is also set via rds_cluster_parameters — it is enabled here so the log group exists and is retention-managed from the moment that parameter is turned on. Pass [] to stop exporting; the log groups are governed separately by rds_managed_log_group_types, so disabling an export never removes a group from state."
+  type        = list(string)
+  default     = ["error", "slowquery"]
+
+  validation {
+    condition     = alltrue([for t in var.rds_enabled_cloudwatch_logs_exports : contains(["audit", "error", "general", "slowquery"], t)])
+    error_message = "Valid Aurora MySQL log types are: audit, error, general, slowquery."
+  }
+}
+
+variable "rds_managed_log_group_types" {
+  description = "MySQL log types whose CloudWatch log groups are created and retention-managed here. Kept separate from rds_enabled_cloudwatch_logs_exports so that disabling an export is not a one-way door: the group stays in state, and re-enabling later is a no-op instead of a ResourceAlreadyExistsException. Should be a superset of the export list."
+  type        = list(string)
+  default     = ["error", "slowquery"]
+
+  validation {
+    condition     = alltrue([for t in var.rds_managed_log_group_types : contains(["audit", "error", "general", "slowquery"], t)])
+    error_message = "Valid Aurora MySQL log types are: audit, error, general, slowquery."
+  }
+}
+
+variable "rds_log_kms_key_id" {
+  description = "ARN of a KMS key to encrypt the RDS CloudWatch log groups. Default null uses the CloudWatch service-managed key. Worth setting for environments whose slow query log will carry customer SQL text. When first setting this, the KMS key policy must grant logs.<region>.amazonaws.com permission to use the key, or CreateLogGroup fails with InvalidParameterException — which reads like a terraform problem and is not."
+  type        = string
+  default     = null
+}
+
+variable "rds_log_retention_days" {
+  description = "Retention for the RDS CloudWatch log groups, in days. Must be finite — 'never expire' is intentionally not offered: that is what RDS applies when it creates the groups itself, and the reason DND-1537 found an orphan holding 3.65 GB of dead data indefinitely."
+  type        = number
+  default     = 90
+
+  validation {
+    condition     = contains([1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1096, 1827, 2192, 2557, 2922, 3288, 3653], var.rds_log_retention_days)
+    error_message = "Must be a finite retention period CloudWatch Logs accepts (1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1096, 1827, 2192, 2557, 2922, 3288, 3653). 0 / never-expire is intentionally not permitted."
+  }
+}
+
 #### comet_s3 ####
 variable "s3_bucket_name" {
   description = "Name for S3 bucket"