log_file_validation_enabled

AWS Ensure Log File Validation Enabled For All CloudTrails

What it does

CloudTrail log file validation creates a digitally signed digest file containing a hash of each log that CloudTrail writes to S3. These digest files can be used to determine whether a log file was changed, deleted, or unchanged after CloudTrail delivered the log. It is recommended that file validation be enabled on all CloudTrails, and this policy raises an incident if any CloudTrails exist without this setting enabled.

Functional Details

The policy leverages the AWS CloudTrail API to obtain a list of trails. Each trail is checked to see if LogFileValidationEnabled is set to "true". If any trails are found with LogFileValidationEnabled set to a value other than "true", an incident is raised with a list of the affected trails.

Input Parameters

• Email addresses of the recipients you wish to notify - A list of email addresses to notify

Policy Actions

• Send an email report

Prerequisites

This policy uses credentials for connecting to the cloud -- in order to apply this policy you must have a credential registered in the system that is compatible with this policy. If there are no credentials listed when you apply the policy, please contact your cloud admin and ask them to register a credential that is compatible with this policy. The information below should be consulted when creating the credential.

Credential configuration

For administrators creating and managing credentials to use with this policy, the following information is needed:

Provider tag value to match this policy: aws , aws_sts

Required permissions in the provider:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cloudtrail:GetTrailStatus"
      ],
      "Resource": "*"
    }
  ]
}

Supported Clouds

• AWS

Cost

This Policy Template does not incur any cloud costs.