CloudTrail log file validation should be enabled

Description

It is recommended that file validation be enabled on all CloudTrail logs because it provides additional integrity checking of the log data.

Remediation Steps

AWS Console

  • Navigate to CloudTrail.

  • In the left navigation, click Trails.

  • Click the target trail.

  • Within General details, click Edit.

  • Scroll down to Additional settings, and enable Log file validation.

  • Click Save changes.

AWS CLI

  • Get a list of all CloudTrail trails and view their configuration:

    • aws cloudtrail describe-trails

  • Update any trail that has “LogFileVaidationEnabled” set to false:

    • aws cloudtrail update-trail --name <trail_name> --enable-log-file-validation

Terraform

  • Ensure that the aws_cloudtrail enable_log_file_validation field is set to “true”.

Example Configuration

resource "aws_cloudtrail" "example" {
  enable_log_file_validation = true
  # other required fields here
}