# Ensure CloudTrail log file validation is enabled

- Source: https://support.icompaas.com/support/solutions/articles/a_1793292191797924-ensure-cloudtrail-log-file-validation-is-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224)
- Last updated: 2026-10-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that log file integrity validation is enabled on every AWS CloudTrail trail. When it is enabled, CloudTrail delivers digitally signed digest files to the S3 bucket, which can be used to verify that delivered log files have not been modified, deleted or forged.

**Rationale**

Without log file validation, an attacker who gains access to the log bucket can alter, forge or delete audit records without detection. This undermines the integrity of the logs, hinders investigations and makes unauthorized changes harder to prove. With validation enabled, any change to a log file after delivery can be detected. The log bucket and its digest files should also be protected with least-privilege access.

**Impact**

-   Makes tampering with or deleting CloudTrail log files detectable
    
-   Strengthens the evidential value of logs for audits and investigations
    
-   Adds a small number of digest files to the S3 bucket; there is no effect on workloads
    

**Default Value**

Log file validation is enabled by default for trails created in the CloudTrail console. It is disabled by default for trails created with the API or AWS CLI.

**Pre-Requisites**

-   IAM permissions: cloudtrail:DescribeTrails and cloudtrail:UpdateTrail
    

**Remediation**

**Test Plan**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the CloudTrail console and select **Trails** in the left menu.
    
3.  Select each trail and, in the **General details** section, check that **Log file validation** is **Enabled**.
    
4.  Repeat for each region in use.
    
5.  If log file validation is disabled for any trail, follow the implementation steps.
    

**CLI:**

List the trails with their log file validation setting:

aws cloudtrail describe-trails --region <REGION> --query "trailList\[\].\[Name,HomeRegion,IsMultiRegionTrail,LogFileValidationEnabled\]" --output table

A trail fails if LogFileValidationEnabled is False.

**Implementation Steps**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the CloudTrail console and select **Trails** in the left menu.
    
3.  Select the trail and, in the **General details** section, choose **Edit**.
    
4.  Under **Additional settings**, select **Log file validation** (**Enabled**).
    
5.  Choose **Save changes**.
    
6.  Repeat for each affected trail in each region in use.
    

**CLI:**

Enable log file validation on the trail:

aws cloudtrail update-trail --name <TRAIL\_NAME> --region <HOME\_REGION> --enable-log-file-validation

**Backout Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the CloudTrail console and select the trail.
    
3.  In the **General details** section, choose **Edit**.
    
4.  Clear **Log file validation**.
    
5.  Choose **Save changes**.
    

**CLI:**

aws cloudtrail update-trail --name <TRAIL\_NAME> --region <HOME\_REGION> --no-enable-log-file-validation

Note: while validation is disabled, changes to newly delivered log files cannot be detected.

**Reference**

-   [https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-intro.html](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-intro.html)
    
-   [https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-enabling.html](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-enabling.html)
    
-   [https://docs.aws.amazon.com/cli/latest/reference/cloudtrail/update-trail.html](https://docs.aws.amazon.com/cli/latest/reference/cloudtrail/update-trail.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.