There should be at least one multi-region CloudTrail trail per AWS account

cloudtrail
이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Description

Ensures an AWS CloudTrail trail is enabled across all AWS regions for each account.

Rationale

The AWS API call history produced by CloudTrail enables security analysis, resource change tracking, and compliance auditing.

Remediation

Perform the following to enable global (Multi-region) CloudTrail logging:

From the console

  1. Sign in to the AWS Management Console and open the IAM console
  2. Click Trails on the left navigation pane
  3. Click Get Started Now, if present
    • Click Add new trail
    • Enter a trail name in the Trail name box
    • Set the Apply trail to all regions option to Yes
    • Specify an S3 bucket name in the S3 bucket box
    • Click Create
  4. If any trails already exist, select the target trail to enable global logging
  5. Click the pencil (edit) icon next to Apply trail to all regions, click Yes, and click Save.
  6. Click the pencil (edit) icon next to Management Events
  7. Click All for the Read/Write Events setting
  8. Click Save

From the command line

Create or update a trail to enable multi-region CloudTrail logging:

  1. To create, run:
aws cloudtrail create-trail --name <trail_name> \
--bucket-name <s3_bucket_for_cloudtrail> \
--is-multi-region-trail
  1. To update, run:
aws cloudtrail update-trail --name <trail_name> \
--is-multi-region-trail