At least one CloudTrail trail should be enabled

How to fix it

• Affects another check: A multi-Region trail, which every route here creates, clears this finding in every Region and CloudTrail.1 too; a single-Region trail clears only its own Region.

In the console

CloudTrail → Trails → Create trail

Storage location

Create new S3 bucket (CloudTrail adds its policy), or an existing bucket whose policy lets CloudTrail write

API activity

Read and Write, so the trail also clears CloudTrail.1

With the AWS CLI

aws cloudtrail create-trail --name <trail-name> --s3-bucket-name <log-bucket-name> --is-multi-region-trail --region <region>

With Terraform

resource "aws_cloudtrail" "this" {
  name                  = var.trail_name
  s3_bucket_name        = var.log_bucket_name
  is_multi_region_trail = true
}