Skip to main content

CloudTrails Should Log Management Events

More Info:​

All your AWS CloudTrail trails should be configured to log Management events in order to record important operations such as EC2 RunInstances, DescribeInstances, TerminateInstances and Console Login.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • AWS Well Architected Framework
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • GDPR
  • HIPAA
  • ISO 27001
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SOC2
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • StateRAMP
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

Sure, here are the step-by-step instructions to remediate the "CloudTrails Must Log Management Events" misconfiguration for AWS:

  1. Open the AWS Management Console and navigate to the CloudTrail service.

  2. Click on the Trails option in the left-hand menu.

  3. Select the trail that you want to modify and click on the Edit button.

  4. Scroll down to the Management events section.

  5. Enable the Log management events toggle switch.

  6. Choose the S3 bucket where you want to store the logs.

  7. Select the SNS topic (optional) to receive notifications.

  8. Click on the Save button to save the changes.

Once you complete these steps, CloudTrail will start logging management events to the specified S3 bucket. This will help you to monitor and track all the changes made to your AWS account, including changes made to IAM users, roles, policies, security groups, and more.

Using CLI

To remediate the "CloudTrails Must Log Management Events" misconfiguration in AWS using AWS CLI, follow the below steps:

  1. Open the AWS CLI on your local machine or EC2 instance.
  2. Run the following command to check if CloudTrail is enabled:
aws cloudtrail describe-trails
  1. If CloudTrail is not enabled, run the following command to create a new trail:
aws cloudtrail create-trail --name <trail-name> --s3-bucket-name <bucket-name> --is-multi-region-trail --include-global-service-events

Replace <trail-name> with the name of the trail you want to create and <bucket-name> with the name of the S3 bucket where you want to store your CloudTrail logs.

  1. If CloudTrail is already enabled, run the following command to update the trail to log management events:
aws cloudtrail update-trail --name <trail-name> --enable-log-file-validation --include-global-service-events --is-multi-region-trail --is-organization-trail

Replace <trail-name> with the name of the trail you want to update.

  1. Verify that management events are being logged by running the following command:
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=CreateTrail

This command will return a list of events related to creating a trail, which confirms that management events are being logged.

By following these steps, you will successfully remediate the "CloudTrails Must Log Management Events" misconfiguration in AWS using AWS CLI.

Using Python

To remediate the "CloudTrails must log management events" misconfiguration in AWS, you can use the following Python code:

  1. First, you need to enable CloudTrail in your AWS account if it is not already enabled. You can do this by using the following Python code:
import boto3

# Create a CloudTrail client
cloudtrail = boto3.client('cloudtrail')

# Create a trail
response = cloudtrail.create_trail(
    Name='my-trail',
    S3BucketName='my-bucket',
    IsMultiRegionTrail=True,
    IncludeGlobalServiceEvents=True,
)

# Enable the trail
cloudtrail.start_logging(Name='my-trail')

Replace my-trail with the name of your CloudTrail trail and my-bucket with the name of your S3 bucket where you want to store the logs.

  1. Once you have enabled CloudTrail, you need to ensure that it is logging management events. You can do this by using the following Python code:
import boto3

# Create a CloudTrail client
cloudtrail = boto3.client('cloudtrail')

# Get the current trail configuration
response = cloudtrail.get_trail_status(Name='my-trail')

# Check if management events are being logged
if not response['IsLogging']:
    print('Management events are not being logged')
    # Update the trail to log management events
    response = cloudtrail.update_trail(
        Name='my-trail',
        IncludeGlobalServiceEvents=True,
    )
    # Start logging
    cloudtrail.start_logging(Name='my-trail')
    print('Management events are now being logged')
else:
    print('Management events are being logged')

This code will check if management events are being logged in your CloudTrail trail. If they are not being logged, it will update the trail configuration to include management events and start logging them.

Note: Make sure that you have appropriate permissions to create and update CloudTrail trails and to start and stop logging.

Using Terraform
resource "aws_cloudtrail" "THIS_TRAIL" {
  name                          = "CLOUDTRAIL_TRAIL_NAME" # replace with your trail name
  s3_bucket_name                = "TRAIL_LOGS_BUCKET_NAME" # replace with your logs bucket
  is_multi_region_trail         = true
  include_global_service_events = true

  # This event_selector block mirrors the CLI:
  # ReadWriteType = "All", IncludeManagementEvents = true
  #
  # IMPORTANT: Terraform fully owns event selectors.
  # If you also need data event selectors, add them here as
  # additional event_selector blocks; do NOT configure them via CLI.
  event_selector {
    read_write_type           = "All"
    include_management_events = true

    # Leaving data resources empty means this selector applies to
    # management events only.
    data_resource {
      type   = "AWS::S3::Object"
      values = [] # keep empty if only management events are required
    }
  }
}

This change does not force replacement of the CloudTrail trail; it updates its event selector configuration in place.

To verify, terraform plan should show an in‑place update to aws_cloudtrail.THIS_TRAIL, with event_selector.read_write_type set to "All" and event_selector.include_management_events set to true (and any prior event selector configuration being replaced by the new definition you provide).

Additional Reading:​