Skip to main content

🛡️ AWS CloudTrail Trail is not integrated with CloudWatch Logs🟢

  • Contextual name: 🛡️ Trail is not integrated with CloudWatch Logs🟢
  • ID: /ce/ca/aws/cloudtrail/trail-cloudwatch-logs-integration
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: SECURITY, RELIABILITY

Logic​

Similar Policies​

Description​

Open File

Description​

This policy identifies AWS CloudTrail trails that are not configured to deliver trail events to Amazon CloudWatch Logs.

Rationale​

Integrating CloudTrail with Amazon CloudWatch Logs provides centralized, near-real-time visibility into AWS API activity. Once trail events are available in CloudWatch Logs, security and operations teams can create metric filters, alarms, dashboards, and queries to detect suspicious behavior, investigate changes, and accelerate incident response.

CloudWatch Logs integration complements S3 log delivery by making audit events easier to monitor as they occur and correlate with other service logs.

Impact​

Enabling CloudWatch Logs integration may increase AWS costs for log ingestion, storage, and retention. Review log retention settings and expected event volume to balance visibility with cost.

Audit​

This policy flags an AWS CloudTrail Trail as INCOMPLIANT when either the CloudWatch Logs Log Group ARN or CloudWatch Logs Role ARN field is empty.

Trails are also flagged as INCOMPLIANT when CloudWatch Logs integration is configured but the associated Log Group or IAM Role is missing from the CMDB.

Remediation​

Open File

Remediation​

Configure CloudWatch Logs Integration​

To support centralized monitoring and alerting for CloudTrail events, configure the trail to deliver logs to an Amazon CloudWatch Logs log group and specify an IAM role that CloudTrail can assume to publish log data.

From Command Line​

If a target log group does not already exist, create one:

aws logs create-log-group \
  --region {{region}} \
  --log-group-name {{log-group-name}}

Create a trust policy document {{cloudtrail-trust-policy}}.json with the following content:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "cloudtrail.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Create the IAM role that CloudTrail will assume to publish log events:

aws iam create-role \
  --role-name {{cloudtrail-cloudwatch-role}} \
  --assume-role-policy-document file://{{cloudtrail-trust-policy}}.json

Create a permissions policy document {{cloudtrail-cloudwatch-policy}}.json with the following content:

... see more

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [CloudTrail.5] CloudTrail trails should be integrated with Amazon CloudWatch Logs1no data
💼 Cloudaware Framework → 💼 Logging and Monitoring Configuration78no data
💼 FedRAMP High Security Controls → 💼 AC-2(4) Automated Audit Actions (M)(H)22no data
💼 FedRAMP High Security Controls → 💼 AC-6(9) Log Use of Privileged Functions (M)(H)732no data
💼 FedRAMP High Security Controls → 💼 AU-2 Event Logging (L)(M)(H)27no data
💼 FedRAMP High Security Controls → 💼 AU-3 Content of Audit Records (L)(M)(H)138no data
💼 FedRAMP High Security Controls → 💼 AU-6(1) Automated Process Integration (M)(H)5no data
💼 FedRAMP High Security Controls → 💼 AU-6(3) Correlate Audit Record Repositories (M)(H)17no data
💼 FedRAMP High Security Controls → 💼 AU-6(4) Central Review and Analysis (H)17no data
💼 FedRAMP High Security Controls → 💼 AU-6(5) Integrated Analysis of Audit Records (H)4no data
💼 FedRAMP High Security Controls → 💼 AU-7(1) Automatic Processing (M)(H)3no data
💼 FedRAMP High Security Controls → 💼 AU-10 Non-repudiation (H)16no data
💼 FedRAMP High Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)274no data
💼 FedRAMP High Security Controls → 💼 CA-7 Continuous Monitoring (L)(M)(H)228no data
💼 FedRAMP High Security Controls → 💼 SI-4(5) System-generated Alerts (M)(H)4no data
💼 FedRAMP High Security Controls → 💼 SI-4(20) Privileged Users (H)4857no data
💼 FedRAMP Low Security Controls → 💼 AU-2 Event Logging (L)(M)(H)27no data
💼 FedRAMP Low Security Controls → 💼 AU-3 Content of Audit Records (L)(M)(H)24no data
💼 FedRAMP Low Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)74no data
💼 FedRAMP Low Security Controls → 💼 CA-7 Continuous Monitoring (L)(M)(H)128no data
💼 FedRAMP Moderate Security Controls → 💼 AC-2(4) Automated Audit Actions (M)(H)22no data
💼 FedRAMP Moderate Security Controls → 💼 AC-6(9) Log Use of Privileged Functions (M)(H)32no data
💼 FedRAMP Moderate Security Controls → 💼 AU-2 Event Logging (L)(M)(H)27no data
💼 FedRAMP Moderate Security Controls → 💼 AU-3 Content of Audit Records (L)(M)(H)138no data
💼 FedRAMP Moderate Security Controls → 💼 AU-6(1) Automated Process Integration (M)(H)5no data
💼 FedRAMP Moderate Security Controls → 💼 AU-6(3) Correlate Audit Record Repositories (M)(H)17no data
💼 FedRAMP Moderate Security Controls → 💼 AU-7(1) Automatic Processing (M)(H)3no data
💼 FedRAMP Moderate Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)74no data
💼 FedRAMP Moderate Security Controls → 💼 CA-7 Continuous Monitoring (L)(M)(H)228no data
💼 FedRAMP Moderate Security Controls → 💼 SI-4(5) System-generated Alerts (M)(H)4no data
💼 NIST CSF v2.0 → 💼 DE.AE-02: Potentially adverse events are analyzed to better understand associated activities51no data
💼 NIST CSF v2.0 → 💼 DE.AE-03: Information is correlated from multiple sources66no data
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events185no data
💼 NIST CSF v2.0 → 💼 DE.CM-02: The physical environment is monitored to find potentially adverse events28no data
💼 NIST CSF v2.0 → 💼 DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events105no data
💼 NIST CSF v2.0 → 💼 DE.CM-06: External service provider activities and services are monitored to find potentially adverse events51no data
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events182no data
💼 NIST CSF v2.0 → 💼 ID.IM-01: Improvements are identified from evaluations47no data
💼 NIST CSF v2.0 → 💼 ID.IM-02: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties61no data
💼 NIST CSF v2.0 → 💼 ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities62no data
💼 NIST CSF v2.0 → 💼 ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded47no data
💼 NIST CSF v2.0 → 💼 ID.RA-07: Changes and exceptions are managed, assessed for risk impact, recorded, and tracked50no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-2(4) Account Management _ Automated Audit Actions1422no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(26) Information Flow Enforcement _ Audit Filtering Actions18no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-6(9) Least Privilege _ Log Use of Privileged Functions1725no data
💼 NIST SP 800-53 Revision 5 → 💼 AU-2 Event Logging427no data
💼 NIST SP 800-53 Revision 5 → 💼 AU-3 Content of Audit Records31338no data
💼 NIST SP 800-53 Revision 5 → 💼 AU-6(1) Audit Record Review, Analysis, and Reporting _ Automated Process Integration15no data
💼 NIST SP 800-53 Revision 5 → 💼 AU-6(3) Audit Record Review, Analysis, and Reporting _ Correlate Audit Record Repositories17no data
💼 NIST SP 800-53 Revision 5 → 💼 AU-6(4) Audit Record Review, Analysis, and Reporting _ Central Review and Analysis17no data
💼 NIST SP 800-53 Revision 5 → 💼 AU-6(5) Audit Record Review, Analysis, and Reporting _ Integrated Analysis of Audit Records4no data
💼 NIST SP 800-53 Revision 5 → 💼 AU-7(1) Audit Record Reduction and Report Generation _ Automatic Processing13no data
💼 NIST SP 800-53 Revision 5 → 💼 AU-10 Non-repudiation516no data
💼 NIST SP 800-53 Revision 5 → 💼 AU-12 Audit Record Generation44774no data
💼 NIST SP 800-53 Revision 5 → 💼 CA-7 Continuous Monitoring628no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(9) Boundary Protection _ Restrict Threatening Outgoing Communications Traffic35no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-3(8) Malicious Code Protection _ Detect Unauthorized Commands13no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-4(5) System Monitoring _ System-generated Alerts4no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-4(20) System Monitoring _ Privileged Users12no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-7(8) Software, Firmware, and Information Integrity _ Auditing Capability for Significant Events17no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-20 Tainting4no data
💼 PCI DSS v3.2.1 → 💼 10.5.3 Promptly back up audit trail files to a centralized log server or media that is difficult to alter.3no data
💼 PCI DSS v3.2.1 → 💼 10.5.4 Write logs for external-facing technologies onto a secure, centralized, internal log server or media device.3no data
💼 PCI DSS v4.0.1 → 💼 10.3.3 Audit log files, including those for external-facing technologies, are promptly backed up to a secure, central, internal log server(s) or other media that is difficult to modify.3no data
💼 PCI DSS v4.0 → 💼 10.3.3 Audit log files, including those for external-facing technologies, are promptly backed up to a secure, central, internal log server(s) or other media that is difficult to modify.3no data