CloudTrail trail has delivered logs to CloudWatch Logs in the last 24 hours
cloudtrail_cloudwatch_logging_enabled
CloudTrail trails are configured to send events to CloudWatch Logs, and show recent delivery within the last 24h. Trails without integration or without recent CloudWatch delivery are identified, across single-Region and multi-Region trails.
Risk
Missing or stale CloudWatch delivery weakens visibility and delays detection, impacting confidentiality and integrity. Adversaries can:
- Hide privilege escalation
- Perform unauthorized resource changes
- Exfiltrate data via API misuse
prowler aws --checks cloudtrail_cloudwatch_logging_enabled
Recommendation
Integrate every trail with CloudWatch Logs and maintain continuous, near-real-time delivery. Enforce least privilege on the delivery role, prefer multi-Region coverage, and implement metric filters and alerts for sensitive actions. Centralize retention to support defense in depth.
Remediation
aws cloudtrail update-trail --name <trail_name> --cloud-watch-logs-log-group-arn <cloudwatch_log_group_arn> --cloud-watch-logs-role-arn <cloudwatch_logs_role_arn>
- In AWS Console, go to CloudTrail > Trails and select the trail
- In the CloudWatch Logs section, click Edit
- Set CloudWatch Logs to Enabled
- Choose an existing Log group (or create new) and select an IAM role with permissions for CreateLogStream/PutLogEvents
- Click Save changes
- After a few minutes, verify events appear in the chosen CloudWatch Logs log group
Source Code
Resource Type
AwsCloudTrailTrail