How to Find AWS CloudTrail Trails with No Log Events
Sending AWS CloudTrail events to CloudWatch Logs facilitates real-time and historic activity logging based on user, API, resource, and IP address, and makes it possible to establish alarms and notifications for anomalous or sensitive account activity.
info
This security check is part of the CIS Amazon Web Services Benchmarks and is rated severity low.
Prerequisites​
This guide assumes that you have already installed and configured Fix Inventory to collect your AWS resources.
Directions​
-
Execute the following
search
command in Fix Inventory Shell:> search is(aws_cloud_trail) and trail_status.is_logging==true and trail_status.latest_delivery_attempt_succeeded < -1d
​kind=aws_cloud_trail, ..., region=fixinventory-poweruser
​kind=aws_cloud_trail, ..., account=poweruser-team -
Pipe the
search
command into thedump
command:> search is(aws_cloud_trail) and trail_status.is_logging==true and trail_status.latest_delivery_attempt_succeeded < -1d | dump
​reported:
​ id: /aws/cloudtrail/123
​ name: some-name
​ ctime: '2022-12-05T22:53:14Z'