Ensure CloudTrail log file validation is enabled

2.2 Logging (AWS CIS Benchmark).

Description

CloudTrail log file validation creates a digitally signed digest file containing a hash of each log that CloudTrail writes to S3. These digest files can be used to determine whether a log file was changed, deleted, or unchanged after CloudTrail delivered the log.

It is recommended that file validation be enabled on all CloudTrails.

Enable log file validation on a given trail via the AWS Management Console

Step 1. Log in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/cloudtrail.

Step 2. Click on Trails on the left navigation pane.

Step 3. Click on the target trail.

Step 4. Within the S3 section, click on the edit icon (pencil).

Step 5. Click on Advanced

Step 6. Click on the Yes radio button in the section "Enable log file validation."

Step 7. Click on Save.

Enable log file validation on a given trail via CLI

Run the following command:

aws cloudtrail update-trail --name <trail_name> --enable-log-file-validation

Note: Periodic validation of logs using these digests can be performed by running the following command: aws cloudtrail validate-logs --trail-arn <trail_arn> --start-time <start_time> --end-time <end_time>