Skip to main content

🛡️ AWS CloudTrail Log File Validation is not enabled🟢

Logic​

Similar Policies​

Similar Internal Rules​

RulePoliciesFlags
✉️ dec-x-b1e1a4941

Description​

Open File

Description​

CloudTrail log file validation creates a digitally signed digest file containing a hash of each log that CloudTrail writes to S3. These digest files can be used to determine whether a log file was changed, deleted, or unchanged after CloudTrail delivered the log. It is recommended that file validation be enabled on all CloudTrails.

Rationale​

Enabling log file validation will provide additional integrity checking of CloudTrail logs.

Audit​

Perform the following on each trail to determine if log file validation is enabled:

From Console​

  1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/cloudtrail.

  2. Click on Trails on the left navigation pane.

  3. For Every Trail:

  • Click on a trail via the link in the Name column.
  • Under the General details section, ensure Log file validation is set to Enabled.
From Command Line​

List all trails:

aws cloudtrail describe-trails

Ensure LogFileValidationEnabled is set to true for each trail.

Default Value​

... see more

Remediation​

Open File

Remediation​

Perform one the following to enable log file validation on a given trail:

Using AWS CloudFormation​

  • CloudFormation template (YAML):
AWSTemplateFormatVersion: '2010-09-09'
Description: Enables log file validation on an existing CloudTrail trail.

Parameters:
  TrailName:
    Type: String
    Description: Name of the existing CloudTrail trail

Resources:
  EnableLogFileValidation:
    Type: AWS::CloudTrail::Trail
    Properties:
      TrailName: !Ref TrailName
      EnableLogFileValidation: true

From Console​

  1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/cloudtrail.
  2. Click on Trails on the left navigation pane.
  3. Click on target trail.
  4. Within the General details section click edit.
  5. Under the Advanced settings section.
  6. Check the enable box under Log file validation.
  7. Click Save changes.

From Command Line​

Enable log file validation on a trail:

aws cloudtrail update-trail --name <trail_name> --enable-log-file-validation

Note: periodic validation of logs using these digests can be performed by running the following command:

... see more

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 APRA CPG 234 → 💼 67a network and user profiling that establishes a baseline of normal activity which, when combined with logging and alerting mechanisms, can enable detection of anomalous activity;1922no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [CloudTrail.4] CloudTrail log file validation should be enabled11no data
💼 CIS AWS v1.2.0 → 💼 2.2 Ensure CloudTrail log file validation is enabled11no data
💼 CIS AWS v1.3.0 → 💼 3.2 Ensure CloudTrail log file validation is enabled11no data
💼 CIS AWS v1.4.0 → 💼 3.2 Ensure CloudTrail log file validation is enabled11no data
💼 CIS AWS v1.5.0 → 💼 3.2 Ensure CloudTrail log file validation is enabled - Level 2 (Automated)11no data
💼 CIS AWS v2.0.0 → 💼 3.2 Ensure CloudTrail log file validation is enabled - Level 2 (Automated)11no data
💼 CIS AWS v3.0.0 → 💼 3.2 Ensure CloudTrail log file validation is enabled - Level 2 (Automated)11no data
💼 CIS AWS v4.0.0 → 💼 3.2 Ensure CloudTrail log file validation is enabled (Automated)1no data
💼 CIS AWS v4.0.1 → 💼 3.2 Ensure CloudTrail log file validation is enabled (Automated)1no data
💼 CIS AWS v5.0.0 → 💼 3.2 Ensure CloudTrail log file validation is enabled (Automated)1no data
💼 CIS AWS v6.0.0 → 💼 4.2 Ensure CloudTrail log file validation is enabled (Automated)1no data
💼 Cloudaware Framework → 💼 Logging and Monitoring Configuration60no data
💼 FedRAMP High Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)3767no data
💼 FedRAMP High Security Controls → 💼 AU-6(1) Automated Process Integration (M)(H)3no data
💼 FedRAMP High Security Controls → 💼 AU-7(1) Automatic Processing (M)(H)1no data
💼 FedRAMP High Security Controls → 💼 AU-9 Protection of Audit Information (L)(M)(H)3810no data
💼 FedRAMP High Security Controls → 💼 AU-11 Audit Record Retention (L)(M)(H)1618no data
💼 FedRAMP High Security Controls → 💼 CM-5(1) Automated Access Enforcement and Audit Records (M)(H)78no data
💼 FedRAMP High Security Controls → 💼 CP-9 System Backup (L)(M)(H)548no data
💼 FedRAMP High Security Controls → 💼 SI-4 System Monitoring (L)(M)(H)145056no data
💼 FedRAMP High Security Controls → 💼 SI-4(4) Inbound and Outbound Communications Traffic (M)(H)68no data
💼 FedRAMP High Security Controls → 💼 SI-7(1) Integrity Checks (M)(H)1no data
💼 FedRAMP High Security Controls → 💼 SI-7(7) Integration of Detection and Response (M)(H)1no data
💼 FedRAMP Low Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)67no data
💼 FedRAMP Low Security Controls → 💼 AU-9 Protection of Audit Information (L)(M)(H)10no data
💼 FedRAMP Low Security Controls → 💼 AU-11 Audit Record Retention (L)(M)(H)18no data
💼 FedRAMP Low Security Controls → 💼 CP-9 System Backup (L)(M)(H)7no data
💼 FedRAMP Low Security Controls → 💼 SI-4 System Monitoring (L)(M)(H)8no data
💼 FedRAMP Moderate Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)67no data
💼 FedRAMP Moderate Security Controls → 💼 AU-6(1) Automated Process Integration (M)(H)3no data
💼 FedRAMP Moderate Security Controls → 💼 AU-7(1) Automatic Processing (M)(H)1no data
💼 FedRAMP Moderate Security Controls → 💼 AU-9 Protection of Audit Information (L)(M)(H)110no data
💼 FedRAMP Moderate Security Controls → 💼 AU-11 Audit Record Retention (L)(M)(H)18no data
💼 FedRAMP Moderate Security Controls → 💼 CM-5(1) Automated Access Enforcement and Audit Records (M)(H)8no data
💼 FedRAMP Moderate Security Controls → 💼 CP-9 System Backup (L)(M)(H)28no data
💼 FedRAMP Moderate Security Controls → 💼 SI-4 System Monitoring (L)(M)(H)79no data
💼 FedRAMP Moderate Security Controls → 💼 SI-4(4) Inbound and Outbound Communications Traffic (M)(H)8no data
💼 FedRAMP Moderate Security Controls → 💼 SI-7(1) Integrity Checks (M)(H)1no data
💼 FedRAMP Moderate Security Controls → 💼 SI-7(7) Integration of Detection and Response (M)(H)1no data
💼 GDPR → 💼 Art. 25 Data protection by design and by default1010no data
💼 GDPR → 💼 Art. 32 Security of processing55no data
💼 ISO/IEC 27001:2013 → 💼 A.12.4.2 Protection of log information12no data
💼 ISO/IEC 27001:2013 → 💼 A.12.4.3 Administrator and operator logs78no data
💼 ISO/IEC 27001:2013 → 💼 A.18.1.3 Protection of records13no data
💼 ISO/IEC 27001:2022 → 💼 5.25 Assessment and decision on information security events13no data
💼 NIST CSF v1.1 → 💼 DE.AE-1: A baseline of network operations and expected data flows for users and systems is established and managed1014no data
💼 NIST CSF v1.1 → 💼 DE.AE-2: Detected events are analyzed to understand attack targets and methods1823no data
💼 NIST CSF v1.1 → 💼 DE.AE-3: Event data are collected and correlated from multiple sources and sensors1837no data
💼 NIST CSF v1.1 → 💼 DE.AE-4: Impact of events is determined1313no data
💼 NIST CSF v1.1 → 💼 DE.CM-1: The network is monitored to detect potential cybersecurity events1841no data
💼 NIST CSF v1.1 → 💼 DE.CM-3: Personnel activity is monitored to detect potential cybersecurity events2026no data
💼 NIST CSF v1.1 → 💼 DE.CM-5: Unauthorized mobile code is detected1111no data
💼 NIST CSF v1.1 → 💼 DE.CM-6: External service provider activity is monitored to detect potential cybersecurity events66no data
💼 NIST CSF v1.1 → 💼 DE.CM-7: Monitoring for unauthorized personnel, connections, devices, and software is performed1823no data
💼 NIST CSF v1.1 → 💼 DE.DP-2: Detection activities comply with all applicable requirements66no data
💼 NIST CSF v1.1 → 💼 DE.DP-3: Detection processes are tested1313no data
💼 NIST CSF v1.1 → 💼 DE.DP-4: Event detection information is communicated2932no data
💼 NIST CSF v1.1 → 💼 DE.DP-5: Detection processes are continuously improved1315no data
💼 NIST CSF v1.1 → 💼 ID.GV-3: Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed13no data
💼 NIST CSF v1.1 → 💼 ID.RA-1: Asset vulnerabilities are identified and documented1315no data
💼 NIST CSF v1.1 → 💼 PR.IP-4: Backups of information are conducted, maintained, and tested47no data
💼 NIST CSF v1.1 → 💼 PR.IP-8: Effectiveness of protection technologies is shared66no data
💼 NIST CSF v1.1 → 💼 PR.PT-1: Audit/log records are determined, documented, implemented, and reviewed in accordance with policy1632no data
💼 NIST CSF v1.1 → 💼 RS.AN-1: Notifications from detection systems are investigated1823no data
💼 NIST CSF v2.0 → 💼 DE.AE-02: Potentially adverse events are analyzed to better understand associated activities33no data
💼 NIST CSF v2.0 → 💼 DE.AE-03: Information is correlated from multiple sources48no data
💼 NIST CSF v2.0 → 💼 DE.AE-04: The estimated impact and scope of adverse events are understood13no data
💼 NIST CSF v2.0 → 💼 DE.AE-06: Information on adverse events is provided to authorized staff and tools32no data
💼 NIST CSF v2.0 → 💼 DE.AE-07: Cyber threat intelligence and other contextual information are integrated into the analysis37no data
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events120no data
💼 NIST CSF v2.0 → 💼 DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events83no data
💼 NIST CSF v2.0 → 💼 DE.CM-06: External service provider activities and services are monitored to find potentially adverse events33no data
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events139no data
💼 NIST CSF v2.0 → 💼 GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed6no data
💼 NIST CSF v2.0 → 💼 ID.AM-03: Representations of the organization's authorized network communication and internal and external network data flows are maintained48no data
💼 NIST CSF v2.0 → 💼 ID.IM-01: Improvements are identified from evaluations25no data
💼 NIST CSF v2.0 → 💼 ID.IM-02: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties38no data
💼 NIST CSF v2.0 → 💼 ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities39no data
💼 NIST CSF v2.0 → 💼 ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded29no data
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected118no data
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected98no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected112no data
💼 NIST CSF v2.0 → 💼 PR.DS-11: Backups of data are created, protected, maintained, and tested9no data
💼 NIST CSF v2.0 → 💼 RS.MA-02: Incident reports are triaged and validated24no data
💼 NIST SP 800-53 Revision 4 → 💼 AU-10 NON-REPUDIATION511no data
💼 NIST SP 800-53 Revision 5 → 💼 AU-6(1) Audit Record Review, Analysis, and Reporting _ Automated Process Integration13no data
💼 NIST SP 800-53 Revision 5 → 💼 AU-7(1) Audit Record Reduction and Report Generation _ Automatic Processing11no data
💼 NIST SP 800-53 Revision 5 → 💼 AU-9 Protection of Audit Information724no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-4 System Monitoring25110no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-7(1) Software, Firmware, and Information Integrity _ Integrity Checks1no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-7(3) Software, Firmware, and Information Integrity _ Centrally Managed Integrity Tools1no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-7(7) Software, Firmware, and Information Integrity _ Integration of Detection and Response1no data
💼 PCI DSS v3.2.1 → 💼 10.5 Secure audit trails so they cannot be altered.515no data
💼 PCI DSS v3.2.1 → 💼 10.5.2 Protect audit trail files from unauthorized modifications.14no data
💼 PCI DSS v3.2.1 → 💼 10.5.5 Use file-integrity monitoring or change-detection software on logs to ensure that existing log data cannot be changed without generating alerts.12no data
💼 PCI DSS v4.0.1 → 💼 10.3.2 Audit log files are protected to prevent modifications by individuals.4no data
💼 PCI DSS v4.0.1 → 💼 10.3.4 File integrity monitoring or change-detection mechanisms is used on audit logs to ensure that existing log data cannot be changed without generating alerts.2no data
💼 PCI DSS v4.0 → 💼 10.3.2 Audit log files are protected to prevent modifications by individuals.24no data
💼 PCI DSS v4.0 → 💼 10.3.4 File integrity monitoring or change-detection mechanisms is used on audit logs to ensure that existing log data cannot be changed without generating alerts.22no data
💼 SOC 2 → 💼 CC4.2-3 Monitors Corrective Action66no data
💼 SOC 2 → 💼 CC5.2-3 Establishes Relevant Security Management Process Controls Activities1535no data
💼 SOC 2 → 💼 CC7.1-2 Monitors Infrastructure and Software811no data