CloudTrail Events Should Be Monitored By CloudWatch Logs
More Info:
AWS CloudTrail events should be monitored with CloudWatch Logs for management and security purposes.Risk Level
LowAddress
SecurityCompliance Standards
CISAWS, CBP, HIPAA, SOC2, GDPR, NIST, AWSWAF, NISTCSF, PCIDSS, FedRAMPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration “CloudTrail Events Should Be Monitored By CloudWatch Logs” in AWS using the AWS console, follow these steps:
- Open the AWS Management Console and navigate to the CloudTrail service.
- Select the trail for which you want to enable CloudWatch Logs monitoring.
- Click on the “Edit” button in the “CloudWatch Logs” section.
- Select the option “Yes” for “Enable CloudWatch Logs”.
- Choose a CloudWatch Logs log group to which you want to send the CloudTrail events.
- Click on the “Save” button to save the changes.
- Verify that the CloudWatch Logs integration is working by checking the log group for the CloudTrail events.
Using CLI
Using CLI
To remediate the misconfiguration “CloudTrail Events Should Be Monitored By CloudWatch Logs” for AWS using AWS CLI, follow these steps:
- Open the AWS CLI on your local machine or EC2 instance.
-
Run the following command to create a new CloudWatch Logs group:
Replace
my-log-group-namewith the name you want to give to your CloudWatch Logs group. -
Run the following command to create a new CloudWatch Logs stream:
Replace
my-log-group-namewith the name of the CloudWatch Logs group you created in step 2, and replacemy-log-stream-namewith the name you want to give to your CloudWatch Logs stream. -
Run the following command to enable CloudTrail log file validation:
Replace
my-trail-namewith the name of the CloudTrail trail you want to enable log file validation for. -
Run the following command to configure CloudTrail to send events to your CloudWatch Logs group:
Replace
my-trail-namewith the name of the CloudTrail trail you want to configure, replacearn:aws:logs:us-east-1:123456789012:log-group:my-log-group-namewith the ARN of the CloudWatch Logs group you created in step 2, and replacearn:aws:iam::123456789012:role/my-cloudtrail-rolewith the ARN of the IAM role you want to use for CloudTrail. Note: You need to have the required permissions to create CloudWatch Logs group, stream and IAM role. - Verify that CloudTrail events are being sent to your CloudWatch Logs group by checking the logs in the CloudWatch Logs console. Congratulations! You have successfully remediated the misconfiguration “CloudTrail Events Should Be Monitored By CloudWatch Logs” for AWS using AWS CLI.
Using Python
Using Python
To remediate this misconfiguration in AWS, you can use the following steps in Python:
- Import the necessary modules:
- Create a CloudWatch Logs client:
- Get a list of all the existing CloudTrail logs:
- For each CloudTrail log, check if it is already being monitored by CloudWatch Logs:
-
Replace the
destinationArnparameter with the ARN of the CloudWatch Logs destination you want to use. - Save the Python script and run it to remediate the misconfiguration.