AWS CloudTrail log validation is not enabled in all regions misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_36
Category - Subcategory	Logging - Disabled or missing
Provider	AWS
Severity	LOW
Framework	CloudFormation, Serverless, Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	38e3d3cf-b694-46ec-8bd2-8f02194b5040

Impact

CloudTrail log file validation creates a digitally signed digest file containing a hash of each log that CloudTrail writes to S3. These digest files can be used to determine whether a log file was changed, deleted, or unchanged after CloudTrail delivered the log. It is recommended that file validation be enabled on all CloudTrails. We recommend enabling log file validation to provide additional integrity checking of CloudTrail logs.

How to Fix

Resource: AWS::CloudTrail::Trail

• Arguments: Properties.EnableLogFileValidation [source,go]

---

{ " Resources: myTrail: Type: AWS::CloudTrail::Trail Properties: ...

• EnableLogFileValidation: True",

}