# 3.1 Ensure CloudTrail is enabled in all regions (Manual) - Source: https://support.icompaas.com/support/solutions/articles/62000234234-3-1-ensure-cloudtrail-is-enabled-in-all-regions-manual- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS Amazon Web Services Foundations Benchmark v5.0.0](https://support.icompaas.com/support/solutions/62000112684) › [CIS AWS Benchmarks](https://support.icompaas.com/support/solutions/folders/62000169233) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) #### Profile Applicability - **Level 1** #### Description: AWS CloudTrail is a service that captures and logs API calls made on your AWS account, providing a detailed audit trail of actions performed in the AWS environment. Enabling CloudTrail in all regions ensures that logs for API calls in every AWS region are captured and stored, allowing for consistent monitoring of activities across the entire AWS environment. It is important to enable CloudTrail in all regions to ensure comprehensive logging for auditing, security monitoring, and compliance. This also helps identify any activities or configuration changes in regions where resources might have been deployed but not previously monitored. #### Rationale: Enabling CloudTrail in all regions ensures: - Complete visibility into the activity across all AWS regions, regardless of where the resources are deployed. - Centralized logging for easier auditing and compliance with security regulations (e.g., HIPAA, SOC 2, PCI DSS). - Early detection of unauthorized or suspicious activity occurring in regions not monitored by default. If CloudTrail is not enabled in all regions, some activities and changes in AWS services might go unnoticed, which could result in missed security incidents or compliance violations. #### Impact: Failure to enable CloudTrail in all regions can result in: - Incomplete monitoring of AWS account activity, leaving some regions untracked. - Inability to detect unauthorized access or misconfigurations in unmonitored regions. - Non-compliance with security and regulatory standards that require comprehensive logging across all regions. Enabling CloudTrail in all regions ensures full visibility and helps with compliance, making it easier to track and audit activity in your AWS environment. #### Default Value: By default, CloudTrail is not enabled in all regions. CloudTrail must be explicitly configured to log events in each region to ensure comprehensive monitoring. #### Pre-Requisites: - AWS CLI installed and configured - IAM permissions: - cloudtrail:DescribeTrails - cloudtrail:UpdateTrail - AWS CloudTrail service should be enabled and configured to deliver logs to an S3 bucket #### Remediation: ##### Test Plan: Using AWS Console: 1. Go to the [CloudTrail Console](https://console.aws.amazon.com/cloudtrail/). 2. Check if CloudTrail is enabled in all regions. - In the CloudTrail Console, navigate to the Trails section and confirm that a trail is configured to log events in all regions. 3. Verify that the logs are being stored in an S3 bucket and that the S3 bucket is accessible and configured correctly for log storage. Using AWS CLI: aws cloudtrail describe-trails --query "TrailList\[?IsMultiRegionTrail==\`true\`\].{TrailName:Name, Region:HomeRegion}" --output table To verify that CloudTrail is logging across all regions: aws cloudtrail get-event-selectors --trail-name --output table ##### Implementation Plan: Using AWS Console: 1. Enable CloudTrail in all regions: - Go to the [CloudTrail Console](https://console.aws.amazon.com/cloudtrail/). - Select the trail you want to configure. - In the Trail Settings, ensure that the Multi-region trail option is selected to log events in all AWS regions. - Save the configuration and verify that the trail is logging events across all regions. 2. Verify log delivery to S3: - Go to the [S3 Console](https://console.aws.amazon.com/s3/). - Confirm that CloudTrail logs are being stored in the configured S3 bucket. Using AWS CLI: 1. Enable CloudTrail in all regions: aws cloudtrail update-trail --name --is-multi-region-trail 2. Verify CloudTrail logging in all regions: aws cloudtrail describe-trails --query "TrailList\[?IsMultiRegionTrail==\`true\`\].{TrailName:Name, Region:HomeRegion}" --output table #### Backout Plan: Using AWS Console: 1. If enabling CloudTrail in all regions creates excessive logging or performance issues: - Go to the [CloudTrail Console](https://console.aws.amazon.com/cloudtrail/). - Disable multi-region logging by unchecking the Multi-region trail option in the Trail Settings. - Alternatively, exclude non-essential regions from logging if there is an overload of data. 2. Modify the S3 bucket settings to reduce storage space or configure lifecycle policies for log data. Using AWS CLI: 1. Temporarily disable multi-region logging: aws cloudtrail update-trail --name --is-multi-region-trail false 2. Stop CloudTrail logging if necessary: aws cloudtrail stop-logging --name 3. Re-enable CloudTrail logging once issues are resolved: aws cloudtrail start-logging --name aws cloudtrail update-trail --name --is-multi-region-trail #### References: - [AWS CloudTrail Documentation ](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html) - [AWS CloudWatch Documentation ](https://docs.aws.amazon.com/cloudwatch/latest/monitoring/) - [AWS IAM Documentation ](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html) #### CIS Controls Mapping:

CIS Control Version

Control ID

Control Description

CIS v8

4.9

Perform Continuous Security Monitoring and Incident Detection

CIS v7

6.3

Monitor Security Configurations for Compliance

CIS v7

5.2

Securely Manage and Monitor Cloud Accounts and Services

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.