Description

Ensure that in every AWS region there is at least one AWS CloudTrail trail that covers the region and is actively logging. A region is covered either by a multi-region trail, which applies to all regions, or by a single-region trail created in that region.

Rationale

Any region without an active trail is a blind spot. Attackers can use regions that are not monitored to run API actions, create resources, make unauthorized changes or move data without leaving a durable audit record. This weakens detection, forensics and incident response. A multi-region trail with logging turned on ensures that activity in every region, including regions not normally used, is recorded.

Impact

  • Records API activity in every region, including regions that are not normally used

  • Closes monitoring gaps that attackers could exploit

  • The first copy of management events in each region is delivered at no charge; S3 storage costs apply for the log files

Default Value

No trail exists by default. CloudTrail Event history shows the last 90 days of management events in each region, but this is not a trail and does not store logs durably. Trails created in the CloudTrail console apply to all regions by default.

Pre-Requisites

  • IAM permissions: cloudtrail:DescribeTrails, cloudtrail:GetTrailStatus, cloudtrail:CreateTrail, cloudtrail:UpdateTrail, cloudtrail:StartLogging and s3:CreateBucket

  • An S3 bucket for the log files with a bucket policy that allows CloudTrail to write to it (the console can create it during the change)

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the CloudTrail console and select Trails in the left menu.

  3. Check whether a trail exists with Multi-region trail set to Yes and Status set to Logging.

  4. If there is no such trail, switch to each region in use and check for a trail in that region with Status set to Logging.

  5. If any region has no logging trail that covers it, follow the implementation steps.

CLI:

List the trails visible in a region, including multi-region trails created in other regions:

aws cloudtrail describe-trails --region <REGION> --query "trailList[].[Name,HomeRegion,IsMultiRegionTrail,TrailARN]" --output table

Check whether a trail is logging (run in its home region):

aws cloudtrail get-trail-status --name <TRAIL_ARN> --region <HOME_REGION> --query "IsLogging"

A region fails if no multi-region trail is logging and no single-region trail in that region is logging.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the CloudTrail console and select Trails in the left menu.

  3. If no suitable trail exists, choose Create trail:

    • enter a Trail name,

    • choose a new or existing S3 bucket for the log files,

    • complete the remaining steps and choose Create trail (the trail applies to all regions and starts logging).

  4. If a trail exists but applies to a single region, select it, choose Edit and enable the option to apply the trail to all regions (Multi-region trail), then choose Save changes.

  5. If the trail Status shows that it is not logging, select the trail and choose Start logging.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the CloudTrail console and select the trail that was created or changed.

  3. To undo a change to an existing trail, choose Edit and restore its previous settings, then choose Save changes.

  4. To undo a new trail, choose Stop logging, or choose Delete to remove it. Log files already delivered to the S3 bucket are kept.

Note: rolling back leaves regions without audit logging, so activity in those regions is no longer recorded.

Reference