CloudTrails Must Log Management Events
More Info:
Your Amazon CloudTrail trail should be configured to use the appropriated S3 bucket in order to meet regulatory compliance requirements within your organizationRisk Level
MediumAddress
SecurityCompliance Standards
SOC2Triage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration “CloudTrails Must Log Management Events” for AWS using the AWS console, follow these steps:
- Log in to the AWS Management Console and navigate to the CloudTrail service.
- Select the Trail that you want to modify and click on the “Edit” button.
- Scroll down to the “Management events” section and ensure that the “Read/Write events” checkbox is selected.
- Click on the “Save” button to save the changes.
- Repeat these steps for all the trails that you have configured in your AWS account.
Using CLI
Using CLI
To remediate the misconfiguration “CloudTrails Must Log Management Events” for AWS using AWS CLI, follow these steps:
- Open the AWS CLI on your local machine or on the AWS console.
-
Run the following command to check if CloudTrail is enabled:
-
If CloudTrail is not enabled, run the following command to create a new trail:
Replace
<trail-name>with the name you want to give to your trail and<bucket-name>with the name of the S3 bucket where you want to store your CloudTrail logs. -
Run the following command to update your trail to log management events:
-
Finally, run the following command to enable your trail:
This will start logging management events to your CloudTrail trail.
Using Python
Using Python
To remediate the misconfiguration “CloudTrails Must Log Management Events” in AWS, you can use the following steps:This code will update the specified trail to log management events. You can run this code for each trail that needs to be remediated.
- Open the AWS Management Console and navigate to the CloudTrail service.
- Select the trail that you want to modify and click on the “Edit” button.
- In the “Management events” section, ensure that “Read/Write events” and “Data events” are selected.
- If “Data events” is not selected, click on the “Add data event” button and select the data events that you want to log.
- If you want to log all data events, select the “All data events” option.
- Click on the “Save” button to save the changes.
- Now, you can use the AWS SDK for Python (Boto3) to automate the remediation process. Here is the Python code to remediate the misconfiguration: