Description

Ensure that every AWS CloudTrail trail is configured to send its events to an Amazon CloudWatch Logs log group and that events have been delivered to CloudWatch Logs within the last 24 hours. This applies to both single-region and multi-region trails.

Rationale

CloudTrail log files in Amazon S3 are not suited to real-time monitoring. Sending trail events to CloudWatch Logs makes it possible to create metric filters and alarms for sensitive activity, such as privilege escalation, unauthorized resource changes or unusual API usage. If a trail is not integrated with CloudWatch Logs, or delivery has stopped, this activity may go unnoticed and incident response is delayed. Every trail should deliver to CloudWatch Logs continuously, using a delivery role with least privilege.

Impact

  • Enables near real-time monitoring, metric filters and alarms on API activity

  • Supports faster detection and investigation of security incidents

  • CloudWatch Logs ingestion and storage costs apply for the delivered events

Default Value

CloudTrail trails are not integrated with CloudWatch Logs by default. The integration must be configured for each trail.

Pre-Requisites

  • IAM permissions: cloudtrail:DescribeTrails, cloudtrail:GetTrailStatus, cloudtrail:UpdateTrail, logs:CreateLogGroup, iam:CreateRole, iam:PutRolePolicy and iam:PassRole

  • A CloudWatch Logs log group in the trail's home region (it can be created during the change)

  • An IAM role that CloudTrail can assume, with permission for logs:CreateLogStream and logs:PutLogEvents on the log group (the console can create it during the change)

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the CloudTrail console and select Trails in the left menu.

  3. Select each trail and check the CloudWatch Logs section for a configured Log group.

  4. If a log group is configured, open it in the CloudWatch console and check that the Last event time of its log streams is within the last 24 hours.

  5. Repeat for each trail in each region in use.

  6. If a trail has no log group, or no events were delivered in the last 24 hours, follow the implementation steps.

CLI:

List the trails with their log group:

aws cloudtrail describe-trails --region <REGION> --query "trailList[].[Name,HomeRegion,IsMultiRegionTrail,CloudWatchLogsLogGroupArn]" --output table

Show the last CloudWatch Logs delivery time of a trail (run in its home region):

aws cloudtrail get-trail-status --name <TRAIL_ARN> --region <HOME_REGION> --query "[LatestCloudWatchLogsDeliveryTime,LatestCloudWatchLogsDeliveryError]"

A trail fails if LatestCloudWatchLogsDeliveryTime is empty (no CloudWatch Logs integration or no delivery yet) or is more than 24 hours old.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the CloudTrail console and select Trails in the left menu.

  3. Select the trail and, in the CloudWatch Logs section, choose Edit.

  4. Select Enabled for CloudWatch Logs.

  5. Choose a new or existing Log group.

  6. Choose a new or existing IAM Role that allows CloudTrail to create log streams and put log events in the log group.

  7. Choose Save changes.

  8. If a log group was already configured but delivery has stopped, check the error returned by the Test Plan command and correct the role permissions or the log group.

  9. Repeat for each affected trail in each region in use.

CLI:

Create the log group, if it does not exist yet:

aws logs create-log-group --log-group-name <LOG_GROUP_NAME> --region <HOME_REGION>

Save the following trust policy as cloudtrail-trust.json:

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"cloudtrail.amazonaws.com"},"Action":"sts:AssumeRole"}]}

Create the delivery role:

aws iam create-role --role-name <ROLE_NAME> --assume-role-policy-document file://cloudtrail-trust.json

Save the following permissions policy as cloudtrail-logs.json:

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["logs:CreateLogStream","logs:PutLogEvents"],"Resource":"arn:aws:logs:<HOME_REGION>:<ACCOUNT_ID>:log-group:<LOG_GROUP_NAME>:log-stream:*"}]}

Attach it to the role:

aws iam put-role-policy --role-name <ROLE_NAME> --policy-name CloudTrailToCloudWatchLogs --policy-document file://cloudtrail-logs.json

Configure the trail to deliver to the log group:

aws cloudtrail update-trail --name <TRAIL_NAME> --region <HOME_REGION> --cloud-watch-logs-log-group-arn arn:aws:logs:<HOME_REGION>:<ACCOUNT_ID>:log-group:<LOG_GROUP_NAME>:* --cloud-watch-logs-role-arn arn:aws:iam::<ACCOUNT_ID>:role/<ROLE_NAME>

Backout Plan

Before making changes, save the current trail configuration:

aws cloudtrail get-trail --name <TRAIL_NAME> --region <HOME_REGION> > trail-backup.json

To roll back:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the CloudTrail console and select the trail.

  3. In the CloudWatch Logs section, choose Edit.

  4. Clear Enabled, or select the log group and role from the saved backup.

  5. Choose Save changes.

Note: removing the CloudWatch Logs integration stops real-time monitoring and alarms based on CloudTrail events.

Reference