diff --git a/apis/database/v1beta1/rdsinstance_types.go b/apis/database/v1beta1/rdsinstance_types.go
index 8827100070..b8bf16c2dd 100644
--- a/apis/database/v1beta1/rdsinstance_types.go
+++ b/apis/database/v1beta1/rdsinstance_types.go
@@ -414,7 +414,7 @@ type RDSInstanceParameters struct {
 	// information, see Publishing Database Logs to Amazon CloudWatch Logs  (http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_LogAccess.html#USER_LogAccess.Procedural.UploadtoCloudWatch)
 	// in the Amazon Relational Database Service User Guide.
 	// +optional
-	EnableCloudwatchLogsExports []string `json:"enableCloudwatchLogsExports,omitempty"`
+	EnableCloudwatchLogsExports []string `json:"enableCloudwatchLogsExports"`
 
 	// EnableIAMDatabaseAuthentication should be true to enable mapping of AWS Identity and Access Management (IAM) accounts
 	// to database accounts, and otherwise false.
diff --git a/pkg/clients/database/rds.go b/pkg/clients/database/rds.go
index 10d18e7e1b..7b7f8b5ace 100644
--- a/pkg/clients/database/rds.go
+++ b/pkg/clients/database/rds.go
@@ -687,12 +687,13 @@ func LateInitialize(in *v1beta1.RDSInstanceParameters, db *rdstypes.DBInstance)
 	}
 	// TODO: remove deprecated field + code. Mapping to EnableCloudwatchLogsExports while in deprecation.
 	//nolint:staticcheck
-	if len(in.EnableCloudwatchLogsExports) == 0 && in.CloudwatchLogsExportConfiguration != nil {
+	if in.EnableCloudwatchLogsExports == nil && in.CloudwatchLogsExportConfiguration != nil {
 		in.EnableCloudwatchLogsExports = in.CloudwatchLogsExportConfiguration.EnableLogTypes
 	}
-
+	if in.EnableCloudwatchLogsExports == nil {
+		in.EnableCloudwatchLogsExports = db.EnabledCloudwatchLogsExports
+	}
 	in.OptionGroupName = lateInitializeOptionGroupName(in.OptionGroupName, db.OptionGroupMemberships)
-
 }
 
 func lateInitializeOptionGroupName(inOptionGroupName *string, members []rdstypes.OptionGroupMembership) *string {
@@ -757,7 +758,7 @@ func IsUpToDate(ctx context.Context, kube client.Client, r *v1beta1.RDSInstance,
 	cloudwatchLogsExportChanged := false
 	// only check CloudwatchLogsExports if there are no pending cloudwatchlogs exports (ignores the apply immediately setting)
 	// (to avoid: "api error InvalidParameterCombination: You cannot configure CloudWatch Logs while a previous configuration is in progress.")
-	if db.PendingModifiedValues != nil && db.PendingModifiedValues.PendingCloudwatchLogsExports == nil {
+	if db.PendingModifiedValues == nil || (db.PendingModifiedValues != nil && db.PendingModifiedValues.PendingCloudwatchLogsExports == nil) {
 		cloudwatchLogsExportChanged = !areSameElements(r.Spec.ForProvider.EnableCloudwatchLogsExports, db.EnabledCloudwatchLogsExports)
 	}
 
diff --git a/pkg/clients/database/rds_test.go b/pkg/clients/database/rds_test.go
index 824e3b5ebb..972d96e8ed 100644
--- a/pkg/clients/database/rds_test.go
+++ b/pkg/clients/database/rds_test.go
@@ -549,6 +549,21 @@ func TestIsUpToDate(t *testing.T) {
 			},
 			want: false,
 		},
+		"EnableCloudwatchLogExportsEmptyAndNil": {
+			args: args{
+				db: rdstypes.DBInstance{
+					EnabledCloudwatchLogsExports: nil,
+				},
+				r: v1beta1.RDSInstance{
+					Spec: v1beta1.RDSInstanceSpec{
+						ForProvider: v1beta1.RDSInstanceParameters{
+							EnableCloudwatchLogsExports: []string{},
+						},
+					},
+				},
+			},
+			want: true,
+		},
 	}
 
 	for name, tc := range cases {
@@ -1130,7 +1145,7 @@ func TestLateInitialize(t *testing.T) {
 				Timezone:                           &zone,
 				DBSecurityGroups:                   []string{name},
 				DBSubnetGroupName:                  subnetGroup.DBSubnetGroupName,
-				EnableCloudwatchLogsExports:        nil,
+				EnableCloudwatchLogsExports:        enabledCloudwatchExports,
 				ProcessorFeatures: []v1beta1.ProcessorFeature{{
 					Name:  name,
 					Value: value,