All checks
High
CloudTrail should be enabled and configured with at least one multi-Region trail that includes read and write management events
Ensures a multi-Region trail, which covers the whole account, records read and write management events. A finding on a trail means its event selectors fall short (with advanced selectors, any readOnly field selector fails it); a finding on a Region means no multi-Region trail exists. An organization trail can be changed only from the management account or a delegated administrator account.
- service
- CloudTrail
- severity
- High
- scope
- evaluated in every region
How to fix it
- Overwrites existing settings: The CLI and Terraform routes replace every event selector on the trail, so include any data event selectors it already logs.
In the console
CloudTrail → Trails → the trail → Management events
- API activity
- Read and Write
With the AWS CLI
aws cloudtrail put-event-selectors --trail-name <trail-name> --event-selectors '[{"ReadWriteType":"All","IncludeManagementEvents":true}]' --region <region>With Terraform
resource "aws_cloudtrail" "this" {
name = var.trail_name
s3_bucket_name = var.log_bucket_name
is_multi_region_trail = true
event_selector {
read_write_type = "All"
include_management_events = true
}
}See which of your accounts this check is failing on.
Book a live scan