CloudTrail SNS topic name undefined

Este producto no es compatible con el sitio Datadog seleccionado. ().
Esta página aún no está disponible en español. Estamos trabajando en su traducción.
Si tienes alguna pregunta o comentario sobre nuestro actual proyecto de traducción, no dudes en ponerte en contacto con nosotros.

Metadata

Id: cloudformation-aws-cloudtrail-sns-topic-name-undefined

Provider: AWS

Platform: CloudFormation

Severity: Low

Category: Observability

Learn More

Description

CloudTrail trails should be configured to publish notifications to an Amazon SNS topic so that security teams receive real-time alerts for suspicious events and automated workflows can be triggered for faster detection and response.

This rule checks AWS::CloudTrail::Trail resources to ensure the SnsTopicName property is defined and non-empty. Resources missing SnsTopicName or with SnsTopicName set to "" will be flagged. Ensure the property references a valid Amazon SNS topic that allows CloudTrail to publish.

Secure example (CloudFormation YAML):

AuditTopic:
  Type: AWS::SNS::Topic

MyTrail:
  Type: AWS::CloudTrail::Trail
  Properties:
    S3BucketName: my-audit-bucket
    IsLogging: true
    SnsTopicName: !Ref AuditTopic

Compliant Code Examples

AWSTemplateFormatVersion: "2010-09-09"
Parameters:
  OperatorEmail:
    Description: "Email address to notify when new logs are published."
    Type: String
Resources:
  myTrail:
    DependsOn:
      - BucketPolicy
      - TopicPolicy
    Type: AWS::CloudTrail::Trail
    Properties:
      EnableLogFileValidation: true
      S3BucketName:
        Ref: S3Bucket
      SnsTopicName:
        Fn::GetAtt:
          - Topic
          - TopicName
      IsLogging: true
      IsMultiRegionTrail: true

Non-Compliant Code Examples

AWSTemplateFormatVersion: "2010-09-09"
Parameters:
  OperatorEmail:
    Description: "Email address to notify when new logs are published."
    Type: String
Resources:
  myTrail3:
    DependsOn:
      - BucketPolicy
      - TopicPolicy
    Type: AWS::CloudTrail::Trail
    Properties:
      S3BucketName:
        Ref: S3Bucket
      IsLogging: false
      IsMultiRegionTrail: true
  myTrail4:
    DependsOn:
      - BucketPolicy
      - TopicPolicy
    Type: AWS::CloudTrail::Trail
    Properties:
      EnableLogFileValidation: false
      S3BucketName:
        Ref: S3Bucket
      SnsTopicName: ""
      IsLogging: false
      IsMultiRegionTrail: true