All checks
Low
CloudTrail log file validation should be enabled
Checks that log file integrity validation is on for the trail, so CloudTrail delivers signed digest files holding a hash of each log file and you can tell whether a log file was changed or deleted after delivery. An organization trail can be changed only from the management account or a delegated administrator account.
- service
- CloudTrail
- severity
- Low
- scope
- evaluated in every region
How to fix it
In the console
CloudTrail → Trails → the trail → General details
- Log file validation
- Enabled
With the AWS CLI
aws cloudtrail update-trail --name <trail-name> --enable-log-file-validation --region <region>With Terraform
resource "aws_cloudtrail" "this" {
name = var.trail_name
s3_bucket_name = var.log_bucket_name
enable_log_file_validation = true
}See which of your accounts this check is failing on.
Book a live scan