Control: 3.2 Ensure CloudTrail log file validation is enabled.
CloudTrail log file validation creates a digitally signed digest file containing a hash of each log that CloudTrail writes to S3. These digest files can be used to determine whether a log file was changed, deleted, or unchanged after CloudTrail delivered the log. It is recommended that file validation be enabled on all CloudTrails.
The AWS API call history produced by CloudTrail enables security analysis, resource change tracking, and compliance auditing. Additionally, enabling log file validation will provide additional integrity checking of CloudTrail logs.
Perform the following to enable global (Multi-region) CloudTrail logging:
- Sign in to the AWS Management Console and open the IAM console at cloudtrail
- Click on
Trailson the left navigation pane
- Click on target trail
- Within the
S3section click on the edit icon (pencil)
- Click on the Yes radio button in section Enable
log file validation
- Click Save
From Command Line
aws cloudtrail update-trail --name <trail_name> --enable-log-file-validation
Note: that periodic validation of logs using these digests can be performed by running the following command:
aws cloudtrail validate-logs --trail-arn <trail_arn> --start-time <start_time> --end-time <end_time>
steampipe check aws_compliance.control.cis_v130_3_2
This control uses a named query:cloudtrail_trail_validation_enabled