HIGH
Source
Trivy/CSPM
CSPM ID
cloudtrail-file-validation
ID
AVD-AWS-0016

Cloudtrail log validation should be enabled to prevent tampering of log data

Log validation should be activated on Cloudtrail logs to prevent the tampering of the underlying data in the S3 bucket. It is feasible that a rogue actor compromising an AWS account might want to modify the log data to remove trace of their actions.

Impact

Illicit activity could be removed from the logs

Follow the appropriate remediation steps below to resolve the issue.

Turn on log validation for Cloudtrail

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
Resources:
  BadExample:
    Type: AWS::CloudTrail::Trail
    Properties:
      IsLogging: true
      IsMultiRegionTrail: true
      EnableLogFileValidation: true
      S3BucketName: "CloudtrailBucket"
      S3KeyPrefix: "/trailing"
      TrailName: "Cloudtrail"

  1. Log in to the AWS Management Console.

  2. Select the “Services” option and search for “CloudTrail”.Step

  3. In the “Dashboard” panel click on the desired trail from the list under “Trails” to get to its configuration page.Step

  4. Click on “Edit” under “General details”. Step

  5. Scroll down and under the “Additional settings” option check for “Log file validation”. If its status is not selected as “Enabled” then the selected trail does not support file validation.Step

  6. Click on the checkbox under “Log file validation” to change its status to “Enabled” so that the “CloudTrail” file validation to determine whether a log file was modified, deleted or unchanged after “CloudTrail” delivered is enabled. Step

  7. Scroll down and click on “Save changes” to enable the CloudTrail log encryption.Step

Turn on log validation for Cloudtrail

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
 resource "aws_cloudtrail" "good_example" {
   is_multi_region_trail = true
   enable_log_file_validation = true
 
   event_selector {
     read_write_type           = "All"
     include_management_events = true
 
     data_resource {
       type = "AWS::S3::Object"
       values = ["${data.aws_s3_bucket.important-bucket.arn}/"]
     }
   }
 }