Description

Ensure that log file integrity validation is enabled on every AWS CloudTrail trail. When it is enabled, CloudTrail delivers digitally signed digest files to the S3 bucket, which can be used to verify that delivered log files have not been modified, deleted or forged.

Rationale

Without log file validation, an attacker who gains access to the log bucket can alter, forge or delete audit records without detection. This undermines the integrity of the logs, hinders investigations and makes unauthorized changes harder to prove. With validation enabled, any change to a log file after delivery can be detected. The log bucket and its digest files should also be protected with least-privilege access.

Impact

  • Makes tampering with or deleting CloudTrail log files detectable

  • Strengthens the evidential value of logs for audits and investigations

  • Adds a small number of digest files to the S3 bucket; there is no effect on workloads

Default Value

Log file validation is enabled by default for trails created in the CloudTrail console. It is disabled by default for trails created with the API or AWS CLI.

Pre-Requisites

  • IAM permissions: cloudtrail:DescribeTrails and cloudtrail:UpdateTrail

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the CloudTrail console and select Trails in the left menu.

  3. Select each trail and, in the General details section, check that Log file validation is Enabled.

  4. Repeat for each region in use.

  5. If log file validation is disabled for any trail, follow the implementation steps.

CLI:

List the trails with their log file validation setting:

aws cloudtrail describe-trails --region <REGION> --query "trailList[].[Name,HomeRegion,IsMultiRegionTrail,LogFileValidationEnabled]" --output table

A trail fails if LogFileValidationEnabled is False.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the CloudTrail console and select Trails in the left menu.

  3. Select the trail and, in the General details section, choose Edit.

  4. Under Additional settings, select Log file validation (Enabled).

  5. Choose Save changes.

  6. Repeat for each affected trail in each region in use.

CLI:

Enable log file validation on the trail:

aws cloudtrail update-trail --name <TRAIL_NAME> --region <HOME_REGION> --enable-log-file-validation

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the CloudTrail console and select the trail.

  3. In the General details section, choose Edit.

  4. Clear Log file validation.

  5. Choose Save changes.

CLI:

aws cloudtrail update-trail --name <TRAIL_NAME> --region <HOME_REGION> --no-enable-log-file-validation

Note: while validation is disabled, changes to newly delivered log files cannot be detected.

Reference