All checks
Low
CloudTrail log file validation should be enabled
Ensures CloudTrail log file integrity validation is enabled, allowing detection of tampering with delivered log files.
- service
- CloudTrail
- severity
- Low
- scope
- evaluated in every region
How to fix it
To comply with this control, log file validation must be enabled for all CloudTrail trails. This feature validates the integrity of CloudTrail log files and ensures that they have not been tampered with after delivery.
- Sign in to the AWS Management Console and open the CloudTrail console at https://console.aws.amazon.com/cloudtrail/.
- In the CloudTrail console, click on 'Trails' in the left navigation pane.
- Select the trail you want to enable log file validation for.
- In the trail details pane, click on the pencil icon next to 'Log file SSE-KMS encryption'.
- In the 'Edit trail' screen, check the box next to 'Enable log file validation'.
- Click on the 'Save' button to apply the changes.
- Optionally, you can also enable log file validation using the AWS CLI with the command: aws cloudtrail update-trail --name <trailname> --enable-log-file-validation
- Verify that log file validation is enabled for all trails by reviewing the trail settings.
See which of your accounts this check is failing on.
Book a demo