Check provider logo

CloudTrail trail S3 bucket has MFA delete enabled

cloudtrail_bucket_requires_mfa_delete

Severitymedium
Servicecloudtrail
by Prowler
identity-accessforensics-ready

CloudTrail log buckets for actively logging trails are evaluated for MFA Delete on the associated S3 bucket. The assessment determines whether MFA Delete is configured on the in-account log bucket; if the bucket resides in another account, its configuration should be verified separately.

Risk

Without MFA Delete, stolen or over-privileged credentials can permanently delete log versions or change versioning, compromising log integrity and availability. This enables attacker cover-ups, hinders forensics, and weakens evidence for investigations.

Run this check with Prowler CLI

prowler aws --checks cloudtrail_bucket_requires_mfa_delete

Run in Prowler Cloud

Recommendation

Enable MFA Delete on the CloudTrail log bucket with versioning enabled. Enforce least privilege so only tightly controlled identities can delete or alter logs, and require MFA for such actions. Apply defense in depth using a dedicated logging account and log file integrity validation.

Remediation

CLI

aws s3api put-bucket-versioning --bucket <CLOUDTRAIL_BUCKET_NAME> --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa "<MFA_SERIAL> <MFA_CODE>"

Other
  1. Sign in to the AWS Management Console as the root user with MFA enabled
  2. Open AWS CloudShell (from the top navigation bar)
  3. Run: 
    aws s3api put-bucket-versioning --bucket <CLOUDTRAIL_BUCKET_NAME> --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa "<MFA_SERIAL> <MFA_CODE>"

Source Code

Resource Type

AwsCloudTrailTrail

References