Ensure CloudTrail Log File Validation Rule
This rule ensures CloudTrail log file validation is enabled for compliance.
| Rule | Ensure CloudTrail log file validation is enabled |
| Framework | cis_v150 |
| Severity | ✔ Low |
Enabling CloudTrail Log File Validation for cis_v150
Description:
CloudTrail log file validation is a security best practice recommended by CIS (Center for Internet Security) for AWS environments. This involves enabling log file integrity checks to ensure the integrity and authenticity of CloudTrail log files. By enabling log file validation, you can verify that the log files have not been tampered with or modified.
Troubleshooting Steps (if applicable):
- 1.Ensure that you have the necessary permissions to modify the AWS CloudTrail settings.
- 2.Verify that you have the required AWS CLI (Command Line Interface) or SDK (Software Development Kit) installed and properly configured.
- 3.Check if CloudTrail service is enabled for your AWS account.
Necessary Codes (if applicable):
No specific code is required for enabling CloudTrail log file validation. The setting can be configured through the AWS Management Console or the AWS CLI.
Step-by-Step Guide for Remediation:
Method 1: Using AWS Management Console
- 1.Open the AWS Management Console in your web browser.
- 2.Go to the CloudTrail service page.
- 3.Select the appropriate CloudTrail trail from the list.
- 4.Click on the "Edit" button in the top right corner.
- 5.In the "Advanced settings" section, locate the "Log file validation" option.
- 6.Ensure that the toggle switch is set to "Enabled" for log file validation.
- 7.Click on the "Save" button to apply the changes.
Method 2: Using AWS CLI
- 1.Open the AWS CLI on your local machine or the command line interface within your AWS environment.
- 2.Run the following command to update the CloudTrail trail with log file validation enabled:
aws cloudtrail update-trail --name <trail-name> --enable-log-file-validation
Replace
<trail-name>- 1.Verify if the changes were applied by running the following command:
aws cloudtrail describe-trails --trail-name-list <trail-name>
Replace
<trail-name>Conclusion:
Enabling CloudTrail log file validation is an important security measure recommended by CIS for AWS environments. By following the provided step-by-step guide, you can ensure the integrity and authenticity of your CloudTrail log files, enhancing the overall security of your AWS infrastructure.