AWSOverview
CloudTrail log file validation creates a digitally signed digest file containing a hash of each log that CloudTrail writes to S3. These digest files can be used to determine whether a log file was changed, deleted, or unchanged after CloudTrail delivered the log. It is recommended that file validation be enabled on all CloudTrails.
Rationale
Enabling log file validation will provide additional integrity checking of CloudTrail logs.
Remediation guidance
Perform the following to enable log file validation on a given trail:
Via the management Console
- Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/cloudtrail
- Click on
Trailson the left navigation pane - Click on target trail
- Within the
S3section click on the edit icon (pencil) - Click
Advanced - Click on the Yes radio button in section
Enable log file validation - Click
Save
Via CLI
aws cloudtrail update-trail --name <trailName> --enable-log-file-validation
Note that periodic validation of logs using these digests can be performed by running the following command:
aws cloudtrail validate-logs --trail-arn <trailARN> --start-time
<startTime> --end-time <endTime>
Default Value
The default value is Not Enabled.
References
- https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-enabling.html
- CCE-78914-9
- CIS CSC v6.0 #6.3
Service-wide remediation
Recommended when many resources are affected: fix the platform baseline first so new resources inherit the secure setting, then remediate the existing flagged resources in batches.
AWS
Use AWS Organizations guardrails, AWS Config rules or conformance packs where they fit, approved account baselines, and IaC modules so new resources inherit the secure setting.
Operational rollout
- Fix the baseline first at the account, subscription, project, cluster, or tenant scope that owns this control.
- Remediate the currently affected resources in batches, starting with internet-exposed and production assets.
- Re-scan and track approved exceptions with an owner and expiry date.
Query logic
These are the stored checks tied to this control.
CloudTrail log file validation is enabled
Connectors
Covered asset types
Expected check: eq []
trails(where:{logFileValidationEnabled:false}){...AssetFragment}
