All checks
High
CloudTrail should be enabled and configured with at least one multi-Region trail that includes read and write management events
Ensures at least one multi-Region trail is configured to record both read and write management events; one such trail covers the whole account. A finding on a trail means its event selectors fall short (with advanced selectors, any readOnly field selector fails it); a finding on a Region means no multi-Region trail exists.
- service
- CloudTrail
- severity
- High
- scope
- evaluated in every region
How to fix it
In the console
CloudTrail → Trails → the trail → Management events
With the AWS CLI
aws cloudtrail put-event-selectors --trail-name <trail-name> --event-selectors '[{"ReadWriteType":"All","IncludeManagementEvents":true}]' --region <region>With Terraform
resource "aws_cloudtrail" "this" {
name = var.trail_name
s3_bucket_name = var.log_bucket_name
is_multi_region_trail = true
event_selector {
read_write_type = "All"
include_management_events = true
}
}See which of your accounts this check is failing on.
Book a demo