lacework-global-53
3.1 Enable CloudTrail in all regions (Automated)
Profile Applicability
• Level 1
Description
AWS CloudTrail is a web service that records AWS API calls for your account and delivers log files to you. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. CloudTrail provides a history of AWS API calls for an account, including API calls made via the Management Console, SDKs, command line tools, and higher-level AWS services (such as CloudFormation).
Rationale
The AWS API call history produced by CloudTrail enables security analysis, resource change tracking, and compliance auditing. Additionally,
ensuring that a multi-regions trail exists will ensure that unexpected activity occurring in otherwise unused regions is detected
ensuring that a multi-regions trail exists will ensure that
Global Service Logging
is enabled for a trail by default to capture recording of events generated on AWS global servicesfor a multi-regions trail, ensuring that management events configured for all type of Read/Writes ensures recording of management operations that are performed on all resources in an AWS account
Impact
S3 lifecycle features can be used to manage the accumulation and management of logs over time. See the following AWS resource for more information on these features:
Audit
Perform the following to determine if CloudTrail is enabled for all regions:
From Console
- Sign in to the AWS Management Console and open the CloudTrail console at https://console.aws.amazon.com/cloudtrail
- Click on
Trails
on the left navigation pane
- You will be presented with a list of trails across all regions
- Ensure at least one Trail has
All
specified in theRegion
column - Click on a trail via the link in the Name column
- Ensure
Logging
is set toON
- Ensure
Apply trail to all regions
is set toYes
- In section
Management Events
ensureRead/Write Events
set toALL
From Command Line
aws cloudtrail describe-trails
Ensure IsMultiRegionTrail
is set to true
aws cloudtrail get-trail-status --name <trailname shown in describe-trails>
Ensure IsLogging
is set to true
aws cloudtrail get-event-selectors --trail-name <trailname shown in describe-trails>
Ensure there is at least one Event Selector for a Trail with IncludeManagementEvents
set to true
and ReadWriteType
set to All
Remediation
Perform the following to enable global (Multi-region) CloudTrail logging:
From Console
The following console steps only work for accounts without a CloudTrail Trail. If the account has at least one trail then skip to the update-trail CLI command, as it is no longer possible to edit the setting for an existing trail via the Console.
- Sign in to the AWS Management Console and open the Identity and Access Management (IAM) console at https://console.aws.amazon.com/cloudtrail.
- Click Trails on the left navigation pane.
- Click
Create trail
. - Fill in the details as requested. (Note: Any trail created via the console is automatically multi-regional).
- Click
Next
. - Choose the events and management events that you want included.
- Click
Next
. - Review the trail and then click
Create trail
.
From Command Line
aws cloudtrail create-trail --name <trail_name> --bucket-name <s3_bucket_for_cloudtrail> --is-multi-region-trail
aws cloudtrail update-trail --name <trail_name> --is-multi-region-trail
Creating CloudTrail via CLI without providing any overriding options configures Management Events
to set All
type of Read/Writes
by default.
References
CCE-78913-1
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-concepts.html#cloudtrail-concepts-management-events
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-management-and-data-events-with-cloudtrail.html?icmpid=docs_cloudtrail_console#logging-management-events
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-supported-services.html#cloud-trail-supported-services-data-events