lacework-global-53
3.1 Ensure CloudTrail is enabled in all regions (Automated)
Profile Applicability
• Level 1
Description
AWS CloudTrail is a web service that records AWS API calls for your account and delivers log files to you. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. CloudTrail provides a history of AWS API calls for an account, including API calls made via the Management Console, SDKs, command line tools, and higher-level AWS services (such as CloudFormation).
Rationale
The AWS API call history produced by CloudTrail enables security analysis, resource change tracking, and compliance auditing. Additionally,
ensuring that a multi-regions trail exists will ensure that unexpected activity occurring in otherwise unused regions is detected
ensuring that a multi-regions trail exists will ensure that
Global Service Logging
is enabled for a trail by default to capture recording of events generated on AWS global servicesfor a multi-regions trail, ensuring that management events configured for all type of Read/Writes ensures recording of management operations that are performed on all resources in an AWS account
Impact
S3 lifecycle features can be used to manage the accumulation and management of logs over time. See the following AWS resource for more information on these features:
Audit
Perform the following to determine if CloudTrail is enabled for all regions:
From Console
- Sign in to the AWS Management Console and open the CloudTrail console at https://console.aws.amazon.com/cloudtrail
- Click on
Trails
on the left navigation pane
- You will be presented with a list of trails across all regions
- Ensure at least one Trail has
All
specified in theRegion
column - Click on a trail via the link in the Name column
- Ensure
Logging
is set toON
- Ensure
Apply trail to all regions
is set toYes
- In section
Management Events
ensureRead/Write Events
set toALL
From Command Line
aws cloudtrail describe-trails
Ensure IsMultiRegionTrail
is set to true
aws cloudtrail get-trail-status --name <trailname shown in describe-trails>
Ensure IsLogging
is set to true
aws cloudtrail get-event-selectors --trail-name <trailname shown in describe-trails>
Ensure there is at least one Event Selector for a Trail with IncludeManagementEvents
set to true
and ReadWriteType
set to All
Remediation
Perform the following to enable global (Multi-region) CloudTrail logging:
From Console
- Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/cloudtrail
- Click on Trails on the left navigation pane
- Click
Get Started Now
, if presented
- Click
Add new trail
- Enter a trail name in the
Trail name
box - Set the
Apply trail to all regions
option toYes
- Specify an S3 bucket name in the
S3 bucket
box - Click
Create
- If 1 or more trails already exist, select the target trail to enable for global logging
- Click the edit icon (pencil) next to
Apply trail to all regions
, ClickYes
and ClickSave
. - Click the edit icon (pencil) next to
Management Events
clickAll
for settingRead/Write Events
and ClickSave
.
From Command Line
aws cloudtrail create-trail --name <trail_name> --bucket-name <s3_bucket_for_cloudtrail> --is-multi-region-trail
aws cloudtrail update-trail --name <trail_name> --is-multi-region-trail
note
Creating CloudTrail via CLI without providing any overriding options configures Management Events
to set All
type of Read/Writes
by default.
References
CCE-78913-1
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-concepts.html#cloudtrail-concepts-management-events
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-management-and-data-events-with-cloudtrail.html?icmpid=docs_cloudtrail_console#logging-management-events
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-supported-services.html#cloud-trail-supported-services-data-events