Rule: CloudTrail trails should be integrated with CloudWatch logs

Rule Description:

Troubleshooting Steps:

2. 1.

   Verify IAM Permissions:

   • Ensure that the IAM user or role used to configure CloudTrail has the necessary permissions to create CloudWatch Logs.
   • Check if the user/role has the

     logs:CreateLogGroup

     and

     logs:CreateLogStream

     permissions.
4. 2.

   Verify CloudTrail Configuration:

   • Confirm if the CloudTrail trail is enabled and capturing logs.
   • Check if the CloudTrail trail is correctly configured to deliver logs to CloudWatch.
6. 3.

   Verify CloudWatch Logs Configuration:

   • Ensure that a CloudWatch Logs log group and log stream exist for storing the CloudTrail logs.
   • Verify the correct log group and log stream names configured in the CloudTrail settings.
8. 4.

   Verify CloudTrail IAM Role:

   • Check if the IAM role associated with the CloudTrail trail has permissions to write logs to CloudWatch Logs.
   • Validate if the role has the

     logs:PutLogEvents

     and

     logs:DescribeLogStreams

     permissions.
10. 5.

    Check CloudTrail and CloudWatch Logs Integration Status:

    • In the CloudTrail console, validate that the integration status with CloudWatch Logs shows as "Enabled."
12. 6.

    Monitor CloudWatch Logs for Errors:

    • Review CloudWatch Logs for any error messages related to the CloudTrail integration.
    • Check for any log delivery issues or errors reported in the CloudWatch Logs console.

Necessary Codes:

Remediation Steps:

2. 1.
   Login to the AWS Management Console.
4. 2.
   Open the CloudTrail service.
6. 3.
   Select the desired trail from the list of trails.
8. 4.
   Click on the "Edit" button, or choose "Trails" from the sidebar menu and select "Edit selected trail".
10. 5.
    In the "Event History" section, find the "Storage Location" option.
12. 6.
    Under "Storage Location," select "Yes" for the option "Enable log file validation."
14. 7.
    Check the box next to "Create a new CloudWatch Logs log group for this trail."
16. 8.
    Enter a unique name for the log group in the "Log group name" field.
18. 9.
    Optionally, you can also create a new log stream by checking the "Create a new CloudWatch Logs log stream for this trail" box and providing a log stream name.
20. 10.
    Choose the appropriate "IAM role" for CloudTrail service.
22. 11.
    Click on "Save" to apply the changes.
24. 12.
    Verify that the CloudTrail trail's integration status with CloudWatch Logs shows as "Enabled" in the CloudTrail console.