CloudTrail Must Log Data Events

More Info:

Your AWS CloudTrail trails should be configured to log Data events in order to record S3 object-level API operations, such as GetObject, DeleteObject and PutObject.

Risk Level

Low

Address

Security

Compliance Standards

• APRA CPS 234 (Australia)
• AWS Startup Security Baseline
• AWS Well Architected Framework
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• DPDPA
• Digital Operational Resilience Act (EU)
• Essential 8
• GDPR
• HIPAA
• ISO 27001
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• Reserve Bank of India (RBI) Cyber Security Framework
• Reserve Bank of India (RBI) Master Direction – Information Technology Framework
• SOC2
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• StateRAMP
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the CloudTrail Must Log Data Events misconfiguration for AWS using the AWS console, follow these steps:

1. Log in to the AWS Management Console.
2. Navigate to the CloudTrail service.
3. Select the trail that is not logging data events.
4. Click on the "Edit" button.
5. Scroll down to the "Data events" section.
6. Click on the "Add data event" button.
7. Select the AWS service(s) that you want to log data events for.
8. Select the specific data events that you want to log.
9. Click on the "Save" button to save the changes.

After completing these steps, CloudTrail will be configured to log data events for the selected AWS service(s) and specific data events.

Using CLI

To remediate the CloudTrail must log data events misconfiguration for AWS using AWS CLI, you can follow the below steps:

1. Open the AWS CLI on your local machine or EC2 instance.

2. Run the following command to check if CloudTrail is enabled:

   aws cloudtrail describe-trails

3. If CloudTrail is not enabled, run the following command to create a trail:

   aws cloudtrail create-trail --name <trail-name> --s3-bucket-name <bucket-name> --is-multi-region-trail

   Replace <trail-name> with a name for your trail and <bucket-name> with the name of the S3 bucket where you want to store the log files.

4. Run the following command to update the trail to log data events:

   aws cloudtrail update-trail --name <trail-name> --include-global-service-events --is-multi-region-trail

   This command updates the trail to include global service events and enables multi-region logging.

5. Run the following command to start logging data events:

   aws cloudtrail start-logging --name <trail-name>

   This command starts logging data events to the specified trail.

6. Verify that data events are being logged by checking the S3 bucket for log files.

By following these steps, you can remediate the CloudTrail must log data events misconfiguration for AWS using AWS CLI.

Using Python

To remediate the misconfiguration "CloudTrail Must Log Data Events" in AWS using Python, you can follow the below steps:

1. Import the necessary libraries:

import boto3

2. Create a boto3 client for CloudTrail:

client = boto3.client('cloudtrail')

3. Get the current CloudTrail configuration:

response = client.get_trail(Name='my-trail')

4. Check if data events logging is enabled:

if not response['Trail']['IsMultiRegionTrail'] or not response['Trail']['IncludeGlobalServiceEvents'] or not response['Trail']['IsLogging']:
    # Data events logging is not enabled

5. Update the CloudTrail configuration to enable data events logging:

response = client.update_trail(
    Name='my-trail',
    IncludeGlobalServiceEvents=True,
    IsMultiRegionTrail=True,
    IsLogging=True,
    S3BucketName='my-bucket',
    S3KeyPrefix='my-prefix'
)

6. Verify that data events logging is enabled:

response = client.get_trail(Name='my-trail')
if response['Trail']['IsMultiRegionTrail'] and response['Trail']['IncludeGlobalServiceEvents'] and response['Trail']['IsLogging']:
    # Data events logging is enabled

7. Optionally, you can also create a CloudWatch alarm to monitor the CloudTrail logs for specific events:

cloudwatch = boto3.client('cloudwatch')
response = cloudwatch.put_metric_alarm(
    AlarmName='my-alarm',
    AlarmDescription='My alarm description',
    MetricName='NumberOfErrors',
    Namespace='AWS/CloudTrail',
    Statistic='Sum',
    Period=300,
    EvaluationPeriods=1,
    Threshold=1,
    ComparisonOperator='GreaterThanThreshold',
    AlarmActions=[
        'arn:aws:sns:us-east-1:123456789012:my-topic'
    ],
    Dimensions=[
        {
            'Name': 'TrailName',
            'Value': 'my-trail'
        }
    ]
)

By following these steps, you can remediate the "CloudTrail Must Log Data Events" misconfiguration in AWS using Python.

Using Terraform

resource "aws_cloudtrail" "TRAIL_RESOURCE_NAME" {
  name                          = "TRAIL_NAME"            # replace with your trail name
  s3_bucket_name                = "CLOUDTRAIL_BUCKET"     # replace with your CloudTrail destination bucket
  include_global_service_events = true
  is_multi_region_trail         = true
  enable_logging                = true

  # WARNING: This block overwrites all existing event selectors for the trail.
  # Manually merge any existing selectors you need to preserve before applying.
  event_selector {
    read_write_type           = "All"
    include_management_events = true

    data_resource {
      type   = "AWS::S3::Object"
      values = ["arn:aws:s3:::"] # logs S3 object-level data events for ALL buckets
      # To target specific buckets instead, use for example:
      # values = ["arn:aws:s3:::MY_CRITICAL_BUCKET/"]
    }
  }
}

This change updates the existing aws_cloudtrail trail in-place (no forced replacement), but it will replace any prior event_selector configuration on this resource, so merge carefully before applying. After updating, terraform plan should show an in-place update for aws_cloudtrail.TRAIL_RESOURCE_NAME with the new event_selector (ReadWriteType All, include_management_events = true, and data_resource for AWS::S3::Object with arn:aws:s3:::).

Additional Reading:

• https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html