3.2 Ensure CloudTrail log file validation is enabled

Information

CloudTrail log file validation creates a digitally signed digest file containing a hash of each log that CloudTrail writes to S3. These digest files can be used to determine whether a log file was changed, deleted, or unchanged after CloudTrail delivered the log. It is recommended that file validation be enabled on all CloudTrails.

Rationale:

Enabling log file validation will provide additional integrity checking of CloudTrail logs.

Solution

Perform the following to enable log file validation on a given trail:
From Console:

Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/cloudtrail

Click on Trails on the left navigation pane

Click on target trail

Within the S3 section click on the edit icon (pencil)

Click Advanced

Click on the Yes radio button in section Enable log file validation

Click Save

From Command Line:

aws cloudtrail update-trail --name <trail_name> --enable-log-file-validation

Note that periodic validation of logs using these digests can be performed by running the following command:

aws cloudtrail validate-logs --trail-arn <trail_arn> --start-time <start_time> --end-time <end_time>

Default Value:

Not Enabled

See Also

https://workbench.cisecurity.org/files/3416

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-6, CSCv6|6, CSCv7|6

Plugin: amazon_aws

Control ID: f8f5118523ad5d50a98bb77906900c7a769c28a2fae0cd158ba4dcd37ba37da5