Skip to main content

CloudTrail Should Be Enabled For All Regions

More Info:​

CloudTrail should be enabled for all AWS regions in order to increase the visibility of the API activity in your AWS account for security and management purposes.

Risk Level​

High

Address​

Reliability, Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • AWS Startup Security Baseline
  • AWS Well Architected Framework
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS AWS
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • FedRAMP
  • GDPR
  • HIPAA
  • ISO 27001
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST
  • NIST CSF
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • PCI
  • Reserve Bank of India (RBI) Cyber Security Framework
  • Reserve Bank of India (RBI) Master Direction – Information Technology Framework
  • SOC2
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • StateRAMP
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To remediate the misconfiguration "CloudTrail Must Be Enabled For All Regions" for AWS, you can follow the below steps:

  1. Log in to your AWS Management Console.
  2. Go to the AWS CloudTrail service homepage.
  3. Click on the "Trails" option from the left-hand menu.
  4. Select the trail that you want to modify from the list of trails.
  5. Click on the "Edit" button.
  6. In the "Management events" section, select "All" from the "Apply trail to all regions" dropdown.
  7. Click on the "Save" button to save the changes.

This configuration change will enable CloudTrail for all regions in your AWS account.

Using CLI

To remediate the misconfiguration "CloudTrail Must Be Enabled For All Regions" for AWS using AWS CLI, follow these steps:

  1. Open the AWS CLI on your local machine or EC2 instance.

  2. Run the following command to enable CloudTrail in all regions:

    aws cloudtrail describe-trails --query 'trailList[*].HomeRegion' --output text | xargs -I {} aws cloudtrail update-trail --name {} --is-multi-region-trail

    This command will use the describe-trails operation to get a list of all CloudTrail trails in your account, and then use the update-trail operation to enable multi-region support for each trail.

  3. Wait for the command to complete and verify that CloudTrail is now enabled for all regions. You can do this by going to the CloudTrail console and checking that there is at least one trail with multi-region support enabled.

That's it! You have successfully remediated the misconfiguration "CloudTrail Must Be Enabled For All Regions" for AWS using AWS CLI.

Using Python

To remediate the "CloudTrail Must Be Enabled For All Regions" misconfiguration for AWS using Python, you can use the boto3 library to enable CloudTrail in all regions.

Here are the steps to remediate the misconfiguration:

  1. Import the necessary libraries:
import boto3
  1. Create a boto3 client for CloudTrail:
cloudtrail_client = boto3.client('cloudtrail')
  1. Get a list of all regions using the boto3 client for EC2:
ec2_client = boto3.client('ec2')
regions = [region['RegionName'] for region in ec2_client.describe_regions()['Regions']]
  1. Loop through each region and enable CloudTrail:
for region in regions:
    try:
        cloudtrail_client.create_trail(
            Name='my-trail',
            S3BucketName='my-bucket',
            IncludeGlobalServiceEvents=True,
            IsMultiRegionTrail=True,
            EnableLogFileValidation=True,
            CloudWatchLogsLogGroupArn='arn:aws:logs:us-east-1:123456789012:log-group:my-log-group:*',
            CloudWatchLogsRoleArn='arn:aws:iam::123456789012:role/my-log-role',
            Tags=[
                {
                    'Key': 'my-key',
                    'Value': 'my-value'
                },
            ]
        )
    except Exception as e:
        print(f"Error enabling CloudTrail in {region}: {e}")

This code will create a CloudTrail trail in each region with the specified settings. If a trail already exists in a region, it will throw an error which will be caught and printed to the console.

Note: You will need to replace the S3BucketName, CloudWatchLogsLogGroupArn, CloudWatchLogsRoleArn, and Tags values with your own values.

Using Terraform
resource "aws_cloudtrail" "multi_region_trail" {
  name                          = "CLOUDTRAIL_TRAIL_NAME" # replace with your trail name
  s3_bucket_name                = "CLOUDTRAIL_LOGS_BUCKET_NAME" # replace with your S3 bucket
  include_global_service_events = true

  # Required to match the CLI remediation:
  is_multi_region_trail = true   # applies the trail to all AWS regions
  enable_logging         = true  # ensures logging is enabled

  # add any other arguments you already use on this trail, e.g.:
  # cloud_watch_logs_group_arn, cloud_watch_logs_role_arn, kms_key_id, etc.
}

This change is an in-place update of the existing trail; it does not force resource replacement.

To verify, terraform plan should show is_multi_region_trail and enable_logging changing from false (or unset) to true on the aws_cloudtrail resource.

Additional Reading:​