CloudTrail trail has log file validation enabled
cloudtrail_log_file_validation_enabled
AWS CloudTrail trails are evaluated for log file integrity validation being enabled (LogFileValidationEnabled).
When enabled, CloudTrail generates signed digest files to verify that S3-delivered log files remain unchanged.
Risk
Without validation, adversaries can alter, forge, or delete audit entries without detection, compromising log integrity and non-repudiation.
This impairs investigations, enables alert evasion, and obscures unauthorized changes across regions or accounts.
prowler aws --checks cloudtrail_log_file_validation_enabled
Recommendation
Enable log file integrity validation on all trails (LogFileValidationEnabled=true).
Enforce least privilege on the logs bucket, retain and protect digest files (e.g., S3 Object Lock/MFA Delete), and monitor validation results to support defense in depth.
Remediation
aws cloudtrail update-trail --name <trail_name> --enable-log-file-validation
- Open the AWS Console and go to CloudTrail
- Click Trails and select <trail_name>
- Click Edit
- In Additional/Advanced settings, check Enable log file validation
- Click Save changes
Source Code
Resource Type
AwsCloudTrailTrail
References
- https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-intro.html
- https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-enabling.html
- https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/aws/CloudTrail/cloudtrail-log-file-integrity-validation.html
- https://deepwiki.com/acantril/learn-cantrill-io-labs/7.1-cloudtrail-log-file-integrity