Alibaba Cloud Action Trail Logging is not enabled for all regions misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_ALI_4
Category - Subcategory	Logging - Disabled or missing
Provider	ALIBABA_CLOUD
Severity	MEDIUM
Framework	Terraform

Impact

This rule ensures that Action Trail in Alibaba Cloud is configured to log events in all regions. Action Trail allows for governance, compliance, and auditing over your Alibaba Cloud account by recording the actions taken on your account across all regions. Logging all regions ensures that you have a complete record of user and API actions throughout your entire cloud environment, providing comprehensive visibility and traceability.

Failing to log all regions can result in incomplete tracking of activity, which could obscure security incidents and hinder compliance and forensic investigations.

How to Fix

Resource: alicloud_actiontrail_trail

• Arguments: trail_region

To mitigate this issue, ensure the trail_region attribute in the alicloud_actiontrail_trail resource is set to All.

Example: [source,go]

resource "alicloud_actiontrail_trail" "example" { ...

• trail_region = "All" }

---