> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec2-aws-10.md).

# AWS CloudTrail trail logs is not integrated with CloudWatch Log misconfiguration detected in code

## Rule Details

|                        |                                      |
| ---------------------- | ------------------------------------ |
| Cortex AppSec Rule ID  | APPSEC2\_AWS\_10                     |
| Category - Subcategory | Logging - Disabled or missing        |
| Provider               | AWS                                  |
| Severity               | LOW                                  |
| Framework              | Terraform, Terraform Plan            |
| Mapped CSPM/KSPM Rule  | 0d07ac51-fbfe-44fe-8edb-3314c9995ee0 |

## Impact

AWS CloudTrail is a web service that records AWS API calls made in a given AWS account. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. CloudTrail uses Amazon S3 for log file storage and delivery, so log files are stored durably. In addition to capturing CloudTrail logs within a specified S3 bucket for long term analysis, realtime analysis can be performed by configuring CloudTrail to send logs to CloudWatch logs. For a trail that is enabled in all regions in an account, CloudTrail sends log files from all those regions to a CloudWatch logs log group. It is recommended that CloudTrail logs be sent to CloudWatch logs.

NOTE: The intent of this recommendation is to ensure AWS account activity is being captured, monitored, and appropriately alarmed on. CloudWatch logs is a native way to accomplish this using AWS services but does not preclude the use of an alternate solution.

Sending CloudTrail logs to CloudWatch logs will facilitate real-time and historic activity logging based on user, API, resource, and IP address, and provides opportunity to establish alarms and notifications for anomalous or sensitivity account activity.

## How to Fix

*Resource:* aws\_cloudtrail

* *Arguments:* cloud\_watch\_logs\_group\_arn \[source,go]

***

## resource "aws\_cloudtrail" "aws\_cloudtrail\_ok" { name = "tf-trail-foobar" cloud\_watch\_logs\_group\_arn = "${aws\_cloudwatch\_log\_group.example.arn}:\*" }


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec2-aws-10.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.