Rule: CloudTrail trails should be integrated with CloudWatch logs

Rule Description:

Troubleshooting Steps:

2. 1.

   Verify CloudTrail trails: Check if you have CloudTrail trails configured for your AWS account. You can access CloudTrail from the AWS Management Console. Ensure that the desired trails are active and collecting logs.

4. 2.

   Confirm CloudWatch log group: Ensure that you have a CloudWatch log group created or designated for FFIEC compliance. If not, create a new log group specifically for this purpose.

6. 3.

   Configure CloudTrail log delivery to CloudWatch: To integrate CloudTrail with CloudWatch logs, you need to enable log delivery. Follow these steps:

   • Navigate to the CloudTrail service in the AWS Management Console.
   • Select the appropriate trail that needs to be integrated.
   • Click on the "Edit" button.
   • In the "Event logging" section, enable logging to CloudWatch Logs.
   • Select the desired log group by specifying its name or create a new one.
   • Click on "Save" to apply the changes.
8. 4.

   Verify CloudWatch log data: After configuring CloudTrail to deliver logs to CloudWatch, ensure that the logs are being received and stored in the designated log group. Take the following steps:

   • Navigate to the CloudWatch service in the AWS Management Console.
   • Open the log group designated for FFIEC compliance.
   • Validate the presence of CloudTrail log data and verify its accuracy and completeness.
   • Apply any necessary filters or queries to analyze the logs effectively.

Necessary Codes:

Step-by-Step Guide for Remediation:

2. 1.
   Log in to the AWS Management Console.
4. 2.
   Open the CloudTrail service.
6. 3.
   Verify that the desired trails are active and collecting logs.
8. 4.
   Create a CloudWatch log group specifically for FFIEC compliance if it doesn't already exist.
10. 5.
    Select the trail you want to integrate with CloudWatch logs.
12. 6.
    Click on the "Edit" button.
14. 7.
    Enable log delivery to CloudWatch Logs by ticking the appropriate checkbox.
16. 8.
    Choose the correct log group from the dropdown or create a new one.
18. 9.
    Click on "Save" to apply the changes.
20. 10.
    Open the CloudWatch service.
22. 11.
    Access the log group designated for FFIEC compliance.
24. 12.
    Validate the presence, accuracy, and completeness of CloudTrail log data.
26. 13.
    Analyze the logs using filters or queries as needed.