# 3.2 Ensure CloudTrail log file validation is enabled (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000234236-3-2-ensure-cloudtrail-log-file-validation-is-enabled-automated- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS Amazon Web Services Foundations Benchmark v5.0.0](https://support.icompaas.com/support/solutions/62000112684) › [CIS AWS Benchmarks](https://support.icompaas.com/support/solutions/folders/62000169233) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) #### Profile Applicability - **Level 1** #### Description: CloudTrail log file validation ensures the integrity of the log files generated by AWS CloudTrail. Enabling log file validation creates a cryptographic hash of each CloudTrail log file, which helps verify that the logs have not been tampered with after being delivered. This feature ensures that CloudTrail logs remain authentic and provides assurance that no unauthorized modifications have been made. Enabling log file validation for CloudTrail ensures that the integrity of your audit logs is preserved, which is essential for security auditing and compliance. #### Rationale: Log file validation for CloudTrail provides the following benefits: - Integrity and authenticity: It ensures that CloudTrail logs are complete and have not been tampered with. - Compliance: Helps meet regulatory requirements for log integrity, such as SOC 2, HIPAA, and PCI-DSS. - Accountability: Prevents log manipulation, ensuring that audit logs can be used as an accurate record of AWS account activity. Without log file validation, it becomes difficult to prove the authenticity of the CloudTrail logs, which can undermine their value during audits or investigations. #### Impact: Failure to enable CloudTrail log file validation can result in: - Potential tampering with CloudTrail logs, which could lead to inaccurate audit trails. - Inability to verify the integrity of CloudTrail logs, making it difficult to detect malicious activity or unauthorized changes. - Non-compliance with regulatory standards that require log file integrity and validation. Enabling this feature ensures that CloudTrail logs are tamper-proof, increasing trust in the logs for auditing and incident investigations. #### Default Value: By default, CloudTrail log file validation is not enabled. You must manually enable this feature for each CloudTrail trail to ensure that logs are validated. #### Pre-Requisites: - AWS CLI installed and configured - IAM permissions: - cloudtrail:DescribeTrails - cloudtrail:UpdateTrail - CloudTrail must be enabled and configured to deliver logs to an S3 bucket #### Remediation: ##### Test Plan: Using AWS Console: 1. Go to the [CloudTrail Console](https://console.aws.amazon.com/cloudtrail/). 2. Verify that Log File Validation is enabled for the CloudTrail trail. 3. Check that CloudTrail is delivering logs to an S3 bucket and the logs are being validated by CloudTrail. Using AWS CLI : aws cloudtrail describe-trails --query "TrailList\[?LogFileValidationEnabled==\`true\`\].{TrailName:Name, LogFileValidationEnabled:LogFileValidationEnabled}" --output table ##### Implementation Plan: Using AWS Console: 1. Enable log file validation for CloudTrail logs: - Go to the [CloudTrail Console](https://console.aws.amazon.com/cloudtrail/). - Select the trail for which you want to enable log file validation. - Under the Log File Validation section, choose Enable and save the changes. 2. Verify log file validation: - In the [CloudTrail Console](https://console.aws.amazon.com/cloudtrail/), confirm that Log File Validation is marked as enabled for the selected trail. - Ensure that logs are being stored in the designated S3 bucket. Using AWS CLI: 1. Enable log file validation for CloudTrail trail: aws cloudtrail update-trail --name --enable-log-file-validation 2. Verify log file validation: aws cloudtrail describe-trails --query "TrailList\[?LogFileValidationEnabled==\`true\`\].{TrailName:Name, LogFileValidationEnabled:LogFileValidationEnabled}" --output table #### Backout Plan: Using AWS Console: 1. If log file validation causes performance issues or excessive resource usage: - Go to the [CloudTrail Console](https://console.aws.amazon.com/cloudtrail/). - Disable log file validation for the CloudTrail trail by selecting Disable in the Log File Validation section. 2. Modify CloudTrail settings to reduce the frequency or scope of log file validation if necessary. Using AWS CLI: 1. Temporarily disable log file validation: aws cloudtrail update-trail --name --no-enable-log-file-validation 2. Stop CloudTrail logging if necessary: aws cloudtrail stop-logging --name 3. Re-enable monitoring once issues are resolved: aws cloudtrail start-logging --name aws cloudtrail update-trail --name --enable-log-file-validation #### References: - [AWS CloudTrail Documentation ](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html) - [AWS CloudWatch Documentation ](https://docs.aws.amazon.com/cloudwatch/latest/monitoring/) - [AWS KMS Documentation ](https://docs.aws.amazon.com/kms/latest/developerguide/) #### CIS Controls Mapping:

CIS Control Version

Control ID

Control Description

CIS v8

4.9

Perform Continuous Security Monitoring and Incident Detection

CIS v7

6.3

Monitor Security Configurations for Compliance

CIS v7

5.2

Securely Manage and Monitor Cloud Accounts and Services

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.