# Ensure CloudTrail trails are integrated with CloudWatch Logs

- Source: https://support.icompaas.com/support/solutions/articles/62000083442-ensure-cloudtrail-trails-are-integrated-with-cloudwatch-logs
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS CIS Benchmark Level 1](https://support.icompaas.com/support/solutions/62000039484) › [CIS Control 6.2](https://support.icompaas.com/support/solutions/folders/62000066017)
- Last updated: 2026-06-04
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Profile Applicability: Level 1

Description:

AWS CloudTrail is a web service that records AWS API calls made in a given AWS account. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. CloudTrail uses Amazon S3 for log file storage and delivery, so log files are stored durably. In addition to capturing CloudTrail logs within a specified S3 bucket for long-term analysis, real-time analysis can be performed by configuring CloudTrail to send logs to CloudWatch Logs. For a trail that is enabled in all regions in an account, CloudTrail sends log files from all those regions to a CloudWatch Logs log group. It is recommended that CloudTrail logs be sent to CloudWatch Logs.

  

Rationale: 

Sending CloudTrail logs to CloudWatch Logs will facilitate real-time and historic activity logging based on user, API, resource, and IP address information and provide an opportunity to establish alarms and notifications for anomalous or sensitive account activity.

  

Impact:

CloudWatch integration enabled you will be able to manage better your AWS infrastructure. This enables you to respond quickly to critical operational events detected with CloudTrail events and captured by CloudWatch logs.

  

Default Value:

By default, CloudTrail trails are not integrated with CloudWatch.

  

Pre-Requisite:

1.  Sign in as an admin or IAM user with the required permissions
    
2.  Need at least one log group
    

  

Remediation:

Audit: 

Perform the following to ensure CloudTrail is configured as prescribed: Via the AWS Management Console 

1.  Sign in to the AWS Management Console
    
2.  open the CloudTrail console at [https://console.aws.amazon.com/cloudtrail/](https://console.aws.amazon.com/cloudtrail/)
    
3.  Click Trails in the left menu.
    

4.  Select the trail you want to examine.
    
5.  Under the CloudWatch logs section check is there any log group mentioned
    

6.   If there is no log group mentioned it means CloudTrail trail is not integrated with CloudWatch 
    

  

Implementation steps:

1.  Sign in to the AWS Management Console
    
2.  open the CloudTrail console at [https://console.aws.amazon.com/cloudtrail/](https://console.aws.amazon.com/cloudtrail/)
    
3.  Select the trail you want to modify
    
4.  Go to the Cloudwatch logs section and click on Edit.
    

5.  Check the Enabled CheckBox
    
6.  Log group - You can use an existing group or else you can create new group
    
7.  Configure IAM Role which will deliver CloudTrail events to CloudWatch Logs,  Create/Select an IAM Role and Policy Name .
    

8.  Click on save changes.
    

  

Backout Plan:

To disable follow the same steps in the implementation section and uncheck the cloudwatch logs checkbox.

  

Using CLI: 

aws cloudtrail update-trail  
  --name MyCloudTrail  
  --cloud-watch-logs-log-group-arn  
  arn:aws:logs:us-east-1:123456789012:log-group:CloudTrail/MyCloudTrailLG:\*  
  --cloud-watch-logs-role-arn  
  arn:aws:iam::123456789012:role/CloudTrail\_CloudWatchLogs\_Role

References:

-   [https://aws.amazon.com/cloudtrail/](https://aws.amazon.com/cloudtrail/) [](https://aws.amazon.com/cloudtrail/%C2%A0)
    
-   [Sending events to CloudWatch Logs - AWS CloudTrail](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/send-cloudtrail-events-to-cloudwatch-logs.html) 
    

  

 CIS Controls:

6.2 Activate audit logging 

    Ensure that local logging has been enabled on all systems and networking devices. 

6.5 Central Log Management 

    Ensure that appropriate logs are being aggregated to a central log management system for analysis and review.

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.