CloudTrail Must Log Data Events
More Info:
Your AWS CloudTrail trails should be configured to log Data events in order to record S3 object-level API operations, such as GetObject, DeleteObject and PutObject.Risk Level
LowAddress
SecurityCompliance Standards
HIPAA, SOC2, GDPR, NIST, ISO27001, AWSWAFTriage and Remediation
Remediation
Using Console
Using Console
To remediate the CloudTrail Must Log Data Events misconfiguration for AWS using the AWS console, follow these steps:
- Log in to the AWS Management Console.
- Navigate to the CloudTrail service.
- Select the trail that is not logging data events.
- Click on the “Edit” button.
- Scroll down to the “Data events” section.
- Click on the “Add data event” button.
- Select the AWS service(s) that you want to log data events for.
- Select the specific data events that you want to log.
- Click on the “Save” button to save the changes.
Using CLI
Using CLI
To remediate the CloudTrail must log data events misconfiguration for AWS using AWS CLI, you can follow the below steps:
- Open the AWS CLI on your local machine or EC2 instance.
-
Run the following command to check if CloudTrail is enabled:
-
If CloudTrail is not enabled, run the following command to create a trail:
Replace
<trail-name>with a name for your trail and<bucket-name>with the name of the S3 bucket where you want to store the log files. -
Run the following command to update the trail to log data events:
This command updates the trail to include global service events and enables multi-region logging.
-
Run the following command to start logging data events:
This command starts logging data events to the specified trail.
- Verify that data events are being logged by checking the S3 bucket for log files.
Using Python
Using Python
To remediate the misconfiguration “CloudTrail Must Log Data Events” in AWS using Python, you can follow the below steps:By following these steps, you can remediate the “CloudTrail Must Log Data Events” misconfiguration in AWS using Python.
- Import the necessary libraries:
- Create a boto3 client for CloudTrail:
- Get the current CloudTrail configuration:
- Check if data events logging is enabled:
- Update the CloudTrail configuration to enable data events logging:
- Verify that data events logging is enabled:
- Optionally, you can also create a CloudWatch alarm to monitor the CloudTrail logs for specific events: