Region has at least one CloudTrail trail logging
cloudtrail_multi_region_enabled
AWS CloudTrail has at least one trail with logging enabled in every region. A multi-region trail or a regional trail counts for coverage in that region.
Risk
Missing coverage in any region creates visibility gaps.
Attackers can use lesser-monitored regions to run API actions, hide unauthorized changes, and exfiltrate data without audit trails, weakening detective controls, hindering forensics, and delaying response (confidentiality and integrity).
prowler aws --checks cloudtrail_multi_region_enabled
prowler aws --checks cloudtrail_multi_region_enabled --fixer
Recommendation
Use a multi-region CloudTrail trail or per-region trails so logging is active in every region, including unused ones.
Centralize logs, enforce least privilege to log stores, and add defense-in-depth with encryption, integrity validation, and retention. Continuously monitor trail health to catch gaps.
Remediation
- In the AWS Console, go to CloudTrail > Trails
- If no trail exists: Click Create trail, enter a name, choose an S3 bucket, set Apply trail to all regions = Yes, then Create (logging starts)
- If a trail exists: Select it, click Edit, set Apply trail to all regions = Yes, Save
- If Status shows Not logging, click Start logging
Source Code
Resource Type
AwsCloudTrailTrail