Rule: CloudTrail trails should be integrated with CloudWatch logs

Rule/Policy Description:

Troubleshooting Steps:

2. 1.

   Missing Permissions: Ensure that the IAM (Identity and Access Management) user or role used to create the CloudWatch Logs integration has the necessary permissions. Ensure that the IAM entity has the

   cloudwatch:CreateLogStream

   and

   cloudwatch:PutLogEvents

   permissions on the CloudWatch Logs group you are using.

4. 2.

   Incorrect Log Group Configuration: Double-check the CloudWatch Logs group configuration to ensure it matches the intended setup. Pay attention to the log group name and region used during the configuration process.

6. 3.

   CloudTrail and CloudWatch Logs in Different Regions: Confirm that both CloudTrail and CloudWatch logs are configured in the same region. Cross-region integration is not supported for CloudTrail and CloudWatch logs.

8. 4.

   Disabled Trail Logging: Ensure that the CloudTrail trail is enabled for logging. If logging is disabled, no logs will be sent to CloudWatch.

Necessary Codes:

# Create a CloudWatch Logs group
aws logs create-log-group --log-group-name <LogGroupName>

# Create a CloudTrail trail and enable logging
aws cloudtrail create-trail --name <TrailName> --s3-bucket-name <S3BucketName> --is-multi-region-trail --enable-log-file-validation --include-global-service-events

# Update the trail to send logs to CloudWatch Logs
aws cloudtrail update-trail --name <TrailName> --cloud-watch-logs-log-group-arn <LogGroupARN> --cloud-watch-logs-role-arn <LogRoleARN>

<LogGroupName>

<TrailName>

<S3BucketName>

<LogGroupARN>

<LogRoleARN>

Step-by-Step Guide for Integration:

2. 1.

   Create a CloudWatch Logs Group:

   • Open the AWS Management Console and go to the CloudWatch service.
   • Navigate to the "Logs" section in the left sidebar and click on "Log groups"
   • Click on "Create log group" and provide a name for the log group. Remember this name for later configuration.
   • Click on "Create" to create the log group.
4. 2.

   Create a CloudTrail Trail:

   • Open the AWS Management Console and go to the CloudTrail service.
   • Click on "Trails" in the left sidebar and then click on "Create trail".
   • Provide a name for the trail and ensure the trail is created in the same region as your resources.
   • Select the S3 bucket where you want to store the CloudTrail logs and enable log file integrity validation for enhanced security.
   • Enable "Read/Write events" and "Management events" to capture relevant logs.
   • Click on "Create" to create the trail.
6. 3.

   Update the Trail to Send Logs to CloudWatch Logs:

   • Keep the CloudTrail trail selected and click on "Edit" in the top navigation bar.
   • Expand the "CloudWatch Logs" section and select "Configure".
   • Select the log group you created in step 1 from the dropdown menu.
   • Specify an IAM role that allows CloudTrail to write logs to your CloudWatch log group.
   • Click on "Save" to update the trail.