# Ensure CloudTrail is enabled in all regions - Source: https://support.icompaas.com/support/solutions/articles/a_179329219282663-ensure-cloudtrail-is-enabled-in-all-regions - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224) - Last updated: 2026-10-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Description** Ensure that in every AWS region there is at least one AWS CloudTrail trail that covers the region and is actively logging. A region is covered either by a multi-region trail, which applies to all regions, or by a single-region trail created in that region. **Rationale** Any region without an active trail is a blind spot. Attackers can use regions that are not monitored to run API actions, create resources, make unauthorized changes or move data without leaving a durable audit record. This weakens detection, forensics and incident response. A multi-region trail with logging turned on ensures that activity in every region, including regions not normally used, is recorded. **Impact** - Records API activity in every region, including regions that are not normally used - Closes monitoring gaps that attackers could exploit - The first copy of management events in each region is delivered at no charge; S3 storage costs apply for the log files **Default Value** No trail exists by default. CloudTrail Event history shows the last 90 days of management events in each region, but this is not a trail and does not store logs durably. Trails created in the CloudTrail console apply to all regions by default. **Pre-Requisites** - IAM permissions: cloudtrail:DescribeTrails, cloudtrail:GetTrailStatus, cloudtrail:CreateTrail, cloudtrail:UpdateTrail, cloudtrail:StartLogging and s3:CreateBucket - An S3 bucket for the log files with a bucket policy that allows CloudTrail to write to it (the console can create it during the change) **Remediation** **Test Plan** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the CloudTrail console and select **Trails** in the left menu. 3. Check whether a trail exists with **Multi-region trail** set to **Yes** and **Status** set to **Logging**. 4. If there is no such trail, switch to each region in use and check for a trail in that region with **Status** set to **Logging**. 5. If any region has no logging trail that covers it, follow the implementation steps. **CLI:** List the trails visible in a region, including multi-region trails created in other regions: aws cloudtrail describe-trails --region --query "trailList\[\].\[Name,HomeRegion,IsMultiRegionTrail,TrailARN\]" --output table Check whether a trail is logging (run in its home region): aws cloudtrail get-trail-status --name --region --query "IsLogging" A region fails if no multi-region trail is logging and no single-region trail in that region is logging. **Implementation Steps** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the CloudTrail console and select **Trails** in the left menu. 3. If no suitable trail exists, choose **Create trail**: - enter a **Trail name**, - choose a new or existing S3 bucket for the log files, - complete the remaining steps and choose **Create trail** (the trail applies to all regions and starts logging). 4. If a trail exists but applies to a single region, select it, choose **Edit** and enable the option to apply the trail to all regions (**Multi-region trail**), then choose **Save changes**. 5. If the trail **Status** shows that it is not logging, select the trail and choose **Start logging**. **Backout Plan** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the CloudTrail console and select the trail that was created or changed. 3. To undo a change to an existing trail, choose **Edit** and restore its previous settings, then choose **Save changes**. 4. To undo a new trail, choose **Stop logging**, or choose **Delete** to remove it. Log files already delivered to the S3 bucket are kept. Note: rolling back leaves regions without audit logging, so activity in those regions is no longer recorded. **Reference** - [https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-create-and-update-a-trail.html](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-create-and-update-a-trail.html) - [https://docs.aws.amazon.com/awscloudtrail/latest/userguide/receive-cloudtrail-log-files-from-multiple-regions.html](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/receive-cloudtrail-log-files-from-multiple-regions.html) - [https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrailconcepts.html](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrailconcepts.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.