All checks
Medium
CloudTrail trails should be integrated with Amazon CloudWatch Logs
Checks that the trail sends its events to a CloudWatch Logs log group, where metric filters and alarms can flag account activity as it happens instead of after the log files reach S3. A multi-Region trail sends every Region's events to one log group. An organization trail can be changed only from the management account or a delegated administrator account.
- service
- CloudTrail
- severity
- Medium
- scope
- evaluated in every region
How to fix it
In the console
CloudTrail → Trails → the trail → CloudWatch Logs
- CloudWatch Logs
- Enabled
- Log group name
- New, or an existing log group in this account and the trail's Region
- Role name
- New, or an existing role CloudTrail can assume that allows logs:CreateLogStream and logs:PutLogEvents
With the AWS CLI
aws cloudtrail update-trail --name <trail-name> --cloud-watch-logs-log-group-arn <log-group-arn> --cloud-watch-logs-role-arn <role-arn> --region <region>With Terraform
resource "aws_cloudtrail" "this" {
name = var.trail_name
s3_bucket_name = var.log_bucket_name
cloud_watch_logs_group_arn = "${var.log_group_arn}:*"
cloud_watch_logs_role_arn = var.cloudwatch_logs_role_arn
}See which of your accounts this check is failing on.
Book a live scan