Free Assessment

AWS_Cloudtrail_2

Ensure CloudTrail log file validation is enabled

Description

CloudTrail log file validation creates a digitally signed digest file containing a hash of each log that CloudTrail writes to S3. These digest files can be used to determine whether a log file was changed, deleted, or unchanged after CloudTrail delivered the log. It is recommended that file validation be enabled on all CloudTrails.

Remediation

Perform the following to enable log file validation on a given trail:


Via the management Console

  1. Sign in to the AWS Management Console and open the IAM console
    at https://console.aws.amazon.com/cloudtrail
  2. Click on Trails on the left navigation pane
  3. Click on target trail
  4. Within the S3 section click on the edit icon (pencil)
  5. Click Advanced
  6. Click on the Yes radio button in section Enable log file validation
  7. Click Save


Via CLI
aws cloudtrail update-trail –name &lt

Service

CloudTrail

Severity

Low

Compliance

Mapping

Start Free Trial
Login

CLOSE

We are now live on AWS Marketplace.
The integrated view of your cloud infrastructure is now easier than ever!

Learn More