> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # CloudTrail Events Should Be Monitored By CloudWatch Logs ### More Info: AWS CloudTrail events should be monitored with CloudWatch Logs for management and security purposes. ### Risk Level Low ### Address Security ### Compliance Standards * APRA CPS 234 (Australia) * AWS Well Architected Framework * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS AWS * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * Cloudanix Best Practice * DPDPA * Digital Operational Resilience Act (EU) * FedRAMP * GDPR * HIPAA * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST * NIST CSF * NIST SP 800-171 * NYDFS 23 NYCRR 500 * PCI * Reserve Bank of India (RBI) Cyber Security Framework * Reserve Bank of India (RBI) Master Direction – Information Technology Framework * SOC2 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * StateRAMP * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation To remediate the misconfiguration "CloudTrail Events Should Be Monitored By CloudWatch Logs" in AWS using the AWS console, follow these steps: 1. Open the AWS Management Console and navigate to the CloudTrail service. 2. Select the trail for which you want to enable CloudWatch Logs monitoring. 3. Click on the "Edit" button in the "CloudWatch Logs" section. 4. Select the option "Yes" for "Enable CloudWatch Logs". 5. Choose a CloudWatch Logs log group to which you want to send the CloudTrail events. 6. Click on the "Save" button to save the changes. 7. Verify that the CloudWatch Logs integration is working by checking the log group for the CloudTrail events. By following these steps, you will have successfully remediated the misconfiguration "CloudTrail Events Should Be Monitored By CloudWatch Logs" in AWS. # To remediate the misconfiguration "CloudTrail Events Should Be Monitored By CloudWatch Logs" for AWS using AWS CLI, follow these steps: 1. Open the AWS CLI on your local machine or EC2 instance. 2. Run the following command to create a new CloudWatch Logs group: ``` aws logs create-log-group --log-group-name my-log-group-name ``` Replace `my-log-group-name` with the name you want to give to your CloudWatch Logs group. 3. Run the following command to create a new CloudWatch Logs stream: ``` aws logs create-log-stream --log-group-name my-log-group-name --log-stream-name my-log-stream-name ``` Replace `my-log-group-name` with the name of the CloudWatch Logs group you created in step 2, and replace `my-log-stream-name` with the name you want to give to your CloudWatch Logs stream. 4. Run the following command to enable CloudTrail log file validation: ``` aws cloudtrail update-trail --name my-trail-name --enable-log-file-validation ``` Replace `my-trail-name` with the name of the CloudTrail trail you want to enable log file validation for. 5. Run the following command to configure CloudTrail to send events to your CloudWatch Logs group: ``` aws cloudtrail update-trail --name my-trail-name --cloud-watch-logs-log-group-arn arn:aws:logs:us-east-1:123456789012:log-group:my-log-group-name --cloud-watch-logs-role-arn arn:aws:iam::123456789012:role/my-cloudtrail-role ``` Replace `my-trail-name` with the name of the CloudTrail trail you want to configure, replace `arn:aws:logs:us-east-1:123456789012:log-group:my-log-group-name` with the ARN of the CloudWatch Logs group you created in step 2, and replace `arn:aws:iam::123456789012:role/my-cloudtrail-role` with the ARN of the IAM role you want to use for CloudTrail. Note: You need to have the required permissions to create CloudWatch Logs group, stream and IAM role. 6. Verify that CloudTrail events are being sent to your CloudWatch Logs group by checking the logs in the CloudWatch Logs console. Congratulations! You have successfully remediated the misconfiguration "CloudTrail Events Should Be Monitored By CloudWatch Logs" for AWS using AWS CLI. To remediate this misconfiguration in AWS, you can use the following steps in Python: 1. Import the necessary modules: ``` import boto3 ``` 2. Create a CloudWatch Logs client: ``` cloudwatch_logs = boto3.client('logs') ``` 3. Get a list of all the existing CloudTrail logs: ``` cloudtrail_logs = boto3.client('cloudtrail') logs = cloudtrail_logs.describe_trails() ``` 4. For each CloudTrail log, check if it is already being monitored by CloudWatch Logs: ``` for log in logs['trailList']: log_name = log['Name'] response = cloudwatch_logs.describe_log_groups(logGroupNamePrefix=log_name) if not response['logGroups']: # Create a new log group for the CloudTrail log cloudwatch_logs.create_log_group(logGroupName=log_name) # Create a CloudWatch Logs subscription filter for the CloudTrail log cloudwatch_logs.put_subscription_filter( logGroupName=log_name, filterName='CloudTrailFilter', filterPattern='', destinationArn='' ) ``` 5. Replace the `destinationArn` parameter with the ARN of the CloudWatch Logs destination you want to use. 6. Save the Python script and run it to remediate the misconfiguration. This script will create a new CloudWatch Logs log group for each CloudTrail log that is not already being monitored, and then create a CloudWatch Logs subscription filter for that log group. This will ensure that all CloudTrail events are monitored by CloudWatch Logs. ```hcl theme={null} # CloudWatch Logs log group to receive CloudTrail events resource "aws_cloudwatch_log_group" "cloudtrail" { name = "CloudTrail/${var.TRAIL_NAME}-Logs" # substitute var or hard-code your trail name retention_in_days = 365 # adjust to your log retention policy } # IAM role that CloudTrail assumes to write to CloudWatch Logs resource "aws_iam_role" "cloudtrail_cloudwatch_logs" { name = "CLOUDTRAIL_LOGS_ROLE_NAME" # replace with your approved IAM role name assume_role_policy = jsonencode({ Version = "2012-10-17" Statement = [ { Effect = "Allow" Principal = { Service = "cloudtrail.amazonaws.com" } Action = "sts:AssumeRole" } ] }) } # Permissions for CloudTrail to write to the log group resource "aws_iam_role_policy" "cloudtrail_cloudwatch_logs" { name = "cloudtrail-to-cloudwatch-logs" role = aws_iam_role.cloudtrail_cloudwatch_logs.id policy = jsonencode({ Version = "2012-10-17" Statement = [ { Sid = "AllowCloudTrailToCreateAndWriteLogs" Effect = "Allow" Action = [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogGroups", "logs:DescribeLogStreams" ] Resource = aws_cloudwatch_log_group.cloudtrail.arn } ] }) } # CloudTrail trail integrated with CloudWatch Logs resource "aws_cloudtrail" "this" { name = var.TRAIL_NAME # replace with your trail name or hard-code s3_bucket_name = "TRAIL_S3_BUCKET_NAME" # replace with your CloudTrail S3 bucket name # These two arguments implement the CLI `update-trail --cloud-watch-logs-log-group-arn ... [--cloud-watch-logs-role-arn ...]` cloud_watch_logs_group_arn = "${aws_cloudwatch_log_group.cloudtrail.arn}:*" cloud_watch_logs_role_arn = aws_iam_role.cloudtrail_cloudwatch_logs.arn # ...keep your existing trail settings here (is_multi_region_trail, kms_key_id, etc.) } ``` Substitute: * `var.TRAIL_NAME` (or `"TRAIL_NAME"`) with the name of the existing CloudTrail trail (`{{asset_label}}` in your CLI example). * `TRAIL_S3_BUCKET_NAME` with the S3 bucket used by the trail. * `CLOUDTRAIL_LOGS_ROLE_NAME` with your approved IAM role name, if you have naming standards. This change is in-place for the trail (no forced replacement). It will create a new log group and IAM role/policy. To verify, `terraform plan` should show: * `+` creation of `aws_cloudwatch_log_group.cloudtrail` * `+` creation of `aws_iam_role.cloudtrail_cloudwatch_logs` and `aws_iam_role_policy.cloudtrail_cloudwatch_logs` * `~` update to `aws_cloudtrail.this` adding `cloud_watch_logs_group_arn` and `cloud_watch_logs_role_arn`. ### Additional Reading: * [https://docs.aws.amazon.com/awscloudtrail/latest/userguide/send-cloudtrail-events-to-cloudwatch-logs.html](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/send-cloudtrail-events-to-cloudwatch-logs.html)