CloudTrail logging disabled

This product is not supported for your selected Datadog site. ().
이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Metadata

Id: 4bb76f17-3d63-4529-bdca-2b454529d774

Cloud Provider: aws

Framework: Terraform

Severity: Medium

Category: Observability

Learn More

Description

This check ensures that logging is enabled for AWS CloudTrail by verifying that the enable_logging attribute is set to true in the resource configuration. Disabling logging (enable_logging = false) prevents the capture of API activity in your AWS account, which can hinder threat detection, audit investigations, and incident response efforts. For security and compliance, CloudTrail logging should always be enabled, as shown below:

resource "aws_cloudtrail" "example" {
  name           = "example"
  s3_bucket_name = "bucketlog"
  enable_logging = true
}

Compliant Code Examples

resource "aws_cloudtrail" "negative1" {
  name                          = "negative_1"
  s3_bucket_name                = "bucketlog"
  enable_logging                = true
}

resource "aws_cloudtrail" "negative2" {
  name                          = "negative_2"
  s3_bucket_name                = "bucketlog"
}

Non-Compliant Code Examples

#this is a problematic code where the query should report a result(s)
resource "aws_cloudtrail" "positive1" {
  name                          = "positive"
  s3_bucket_name                = "bucketlog"
  enable_logging                = false
}