CloudTrail Must Be Enabled For All Regions
More Info:
CloudTrail should be enabled for all AWS regions in order to increase the visibility of the API activity in your AWS account for security and management purposes.Risk Level
HighAddress
Reliability, SecurityCompliance Standards
HIPAA, PCIDSS, GDPR, CISAWS, CBP, NIST, SOC2, ISO27001, AWSWAF, NISTCSF, FedRAMPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration “CloudTrail Must Be Enabled For All Regions” for AWS, you can follow the below steps:
- Log in to your AWS Management Console.
- Go to the AWS CloudTrail service homepage.
- Click on the “Trails” option from the left-hand menu.
- Select the trail that you want to modify from the list of trails.
- Click on the “Edit” button.
- In the “Management events” section, select “All” from the “Apply trail to all regions” dropdown.
- Click on the “Save” button to save the changes.
Using CLI
Using CLI
To remediate the misconfiguration “CloudTrail Must Be Enabled For All Regions” for AWS using AWS CLI, follow these steps:
- Open the AWS CLI on your local machine or EC2 instance.
-
Run the following command to enable CloudTrail in all regions:
This command will use the
describe-trailsoperation to get a list of all CloudTrail trails in your account, and then use theupdate-trailoperation to enable multi-region support for each trail. - Wait for the command to complete and verify that CloudTrail is now enabled for all regions. You can do this by going to the CloudTrail console and checking that there is at least one trail with multi-region support enabled.
Using Python
Using Python
To remediate the “CloudTrail Must Be Enabled For All Regions” misconfiguration for AWS using Python, you can use the boto3 library to enable CloudTrail in all regions.Here are the steps to remediate the misconfiguration:This code will create a CloudTrail trail in each region with the specified settings. If a trail already exists in a region, it will throw an error which will be caught and printed to the console.Note: You will need to replace the S3BucketName, CloudWatchLogsLogGroupArn, CloudWatchLogsRoleArn, and Tags values with your own values.
- Import the necessary libraries:
- Create a boto3 client for CloudTrail:
- Get a list of all regions using the boto3 client for EC2:
- Loop through each region and enable CloudTrail: