steampipe plugin install awssteampipe plugin install aws

Table: aws_cloudtrail_trail

AWS CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of an AWS account. With CloudTrail, one can log, continuously monitor, and retain account activity related to actions across the AWS infrastructure.

Examples

Basic info

select
  name,
  home_region,
  is_multi_region_trail
from
  aws_cloudtrail_trail

List trails that are not encrypted

select
  name,
  kms_key_id
from
  aws_cloudtrail_trail
where
  kms_key_id is null;

List trails that store logs in publicly accessible S3 buckets

select
  trail.name as trail_name,
  bucket.name as bucket_name,
  bucket.bucket_policy_is_public as is_publicly_accessible
from
  aws_cloudtrail_trail as trail
  join aws_s3_bucket as bucket on trail.s3_bucket_name = bucket.name
where
  bucket.bucket_policy_is_public;

List trails that store logs in an S3 bucket with versioning disabled

select
  trail.name as trail_name,
  bucket.name as bucket_name,
  logging
from
  aws_cloudtrail_trail as trail
  join aws_s3_bucket as bucket on trail.s3_bucket_name = bucket.name
where
  not versioning_enabled;

List trails that do not send log events to CloudWatch Logs

select
  name,
  is_logging
from
  aws_cloudtrail_trail
where
  not is_logging;

List trails with log file validation disabled

select
  name,
  arn,
  log_file_validation_enabled
from
  aws_cloudtrail_trail
where
  not log_file_validation_enabled;

List shadow trails

select
  name,
  arn,
  region,
  home_region
from
  aws_cloudtrail_trail
where
  is_multi_region_trail
  and home_region <> region;

Query examples

Control examples

.inspect aws_cloudtrail_trail

AWS CloudTrail Trail

Name	Type	Description
_ctx	jsonb	Steampipe context in JSON form, e.g. connection_name.
account_id	text	The AWS Account ID in which the resource is located.
advanced_event_selectors	jsonb	Describes the advanced event selectors that are configured for the trail.
akas	jsonb	Array of globally unique identifier strings (also known as) for the resource.
arn	text	The Amazon Resource Name (ARN) of the trail.
cloudwatch_logs_role_arn	text	Specifies the role for the CloudWatch Logs endpoint to assume to write to a user's log group.
event_selectors	jsonb	Describes the event selectors that are configured for the trail.
has_custom_event_selectors	boolean	Specifies whether the trail has custom event selectors, or not.
has_insight_selectors	boolean	Specifies whether a trail has insight types specified in an InsightSelector list, or not.
home_region	text	The region in which the trail was created.
include_global_service_events	boolean	Specifies whether to include AWS API calls from AWS global services, or not.
insight_selectors	jsonb	A JSON string that contains the insight types you want to log on a trail.
is_logging	boolean	Specifies whether the CloudTrail is currently logging AWS API calls, or not.
is_multi_region_trail	boolean	Specifies whether the trail exists only in one region or exists in all regions.
is_organization_trail	boolean	Specifies whether the trail is an organization trail, or not.
kms_key_id	text	Specifies the KMS key ID that encrypts the logs delivered by CloudTrail.
latest_cloudwatch_logs_delivery_error	text	Displays any CloudWatch Logs error that CloudTrail encountered when attempting to deliver logs to CloudWatch Logs.
latest_cloudwatch_logs_delivery_time	timestamp with time zone	Displays the most recent date and time when CloudTrail delivered logs to CloudWatch Logs.
latest_delivery_error	text	Displays any Amazon S3 error that CloudTrail encountered when attempting to deliver log files to the designated bucket.
latest_delivery_time	timestamp with time zone	Specifies the date and time that CloudTrail last delivered log files to an account's Amazon S3 bucket.
latest_digest_delivery_error	text	Displays any Amazon S3 error that CloudTrail encountered when attempting to deliver a digest file to the designated bucket.
latest_digest_delivery_time	timestamp with time zone	Specifies the date and time that CloudTrail last delivered a digest file to an account's Amazon S3 bucket.
latest_notification_error	text	Displays any Amazon SNS error that CloudTrail encountered when attempting to send a notification.
latest_notification_time	timestamp with time zone	Specifies the date and time of the most recent Amazon SNS notification that CloudTrail has written a new log file to an account's Amazon S3 bucket.
log_file_validation_enabled	boolean	Specifies whether log file validation is enabled, or not.
log_group_arn	text	Specifies an Amazon Resource Name (ARN), a unique identifier that represents the log group to which CloudTrail logs will be delivered.
name	text	The name of the trail.
partition	text	The AWS partition in which the resource is located (aws, aws-cn, or aws-us-gov).
region	text	The AWS Region in which the resource is located.
s3_bucket_name	text	Name of the Amazon S3 bucket into which CloudTrail delivers your trail files.
s3_key_prefix	text	Specifies the Amazon S3 key prefix that comes after the name of the bucket you have designated for log file delivery.
sns_topic_arn	text	Specifies the ARN of the Amazon SNS topic that CloudTrail uses to send notifications when log files are delivered.
start_logging_time	timestamp with time zone	Specifies the most recent date and time when CloudTrail started recording API calls for an AWS account.
stop_logging_time	timestamp with time zone	Specifies the most recent date and time when CloudTrail stopped recording API calls for an AWS account.
tags	jsonb	A map of tags for the resource.
tags_src	jsonb	A list of tags assigned to the trail.
title	text	Title of the resource.

turbot/aws