CloudTrail trails should be integrated with CloudWatch logs¶

Use AWS CloudWatch to centrally collect and manage log event activity. Inclusion of AWS CloudTrail data provides details of API call activity within your AWS account.

How to fix¶

Attribute cloud_watch_logs_group_arn of aws_cloudtrail must be non-empty.

Implementation options¶

Choose the option that matches how you manage Terraform. All options satisfy this control.

Option 1: Terraform AWS provider resources¶

If you manage resources directly, configure the relevant Terraform AWS provider resources to meet this control. See docs for the resources involved: aws_cloudtrail.

resource "aws_cloudtrail" "this" {
  advanced_event_selector {
    field_selector {
      equals = ["Data"]
      field  = "eventCategory"
    }
    field_selector {
      equals = ["AWS::S3::Object"]
      field  = "resources.type"
    }

    name = "Log all S3 data events"
  }

  name           = "pofix-example-trail"
  s3_bucket_name = "example-bucket-abc123"

  cloud_watch_logs_group_arn = "arn:aws:logs:us-east-1:123456789012:log-group:example-log-group"
}

Tool mappings¶

Use these identifiers to cross-reference this control across tools, reports, and evidence.

• Compliance.tf (CTF) Control: cloudtrail_trail_integrated_with_logs

• Checkov Check: CKV2_AWS_10

• Powerpipe Control: aws_compliance.control.cloudtrail_trail_integrated_with_logs