All checks
High
At least one CloudTrail trail should be enabled
Verifies that each Region has at least one CloudTrail trail, which delivers a lasting record of API calls to S3 beyond the 90 days of event history CloudTrail keeps on its own. A failing finding names the Region that has no trail.
- service
- CloudTrail
- severity
- High
- scope
- evaluated in every region
How to fix it
In the console
CloudTrail → Trails → Create trail
With the AWS CLI
aws cloudtrail create-trail --name <trail-name> --s3-bucket-name <log-bucket-name> --is-multi-region-trail --region <region>With Terraform
resource "aws_cloudtrail" "this" {
name = var.trail_name
s3_bucket_name = var.log_bucket_name
is_multi_region_trail = true
}See which of your accounts this check is failing on.
Book a demo