How to Find AWS CloudTrail without Log File Validation
Enabling log file validation will provide additional integrity checking of CloudTrail logs.
This security check is part of the CIS Amazon Web Services Benchmarks and is rated severity medium.
This guide assumes that you have already installed and configured Resoto to collect your AWS cloud resources.
Execute the following
searchcommand in Resoto Shell or Resoto UI:
> search is(aws_cloud_trail) and trail_status.is_logging==true and trail_log_file_validation_enabled==false
kind=aws_cloud_trail, ..., region=resoto-poweruser
kind=aws_cloud_trail, ..., account=poweruser-team
searchcommand into the
> search is(aws_cloud_trail) and trail_status.is_logging==true and trail_log_file_validation_enabled==false | dump
The command output will list the details of all non-compliant
Fix detected issues by following the remediation steps:
Ensure LogFileValidationEnabled is set to true for each trail.note
Please refer to the AWS CloudTrail documentation for details.