---
title: There should be at least one multi-region CloudTrail trail per AWS account
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > There should be at least one
  multi-region CloudTrail trail per AWS account
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# There should be at least one multi-region CloudTrail trail per AWS account
 
## Description{% #description %}

AWS accounts should have at least one CloudTrail trail that is multi-region, actively logging, and capturing all read and write management events. A trail passes when it uses a basic event selector with management events included and API activity set to all, or an advanced event selector with `eventCategory` equal to `Management` and no `readOnly` field selector. As in the CIS audit, other field selectors on that advanced selector (for example, an `eventSource` exclusion) are not evaluated. A multi-region trail detects unexpected activity in otherwise unused regions and records API calls for AWS global services, supporting security analysis, change tracking, and compliance auditing.

## Remediation{% #remediation %}

In the [CloudTrail console](https://console.aws.amazon.com/cloudtrail), create a trail (console-created trails are multi-region by default) or run `aws cloudtrail update-trail --name <trail-name> --is-multi-region-trail` on an existing trail, and make sure logging is turned on. Under **Management events**, select both **Read** and **Write** API activity, or configure an advanced event selector with `eventCategory` equal to `Management` and no `readOnly` filter, as described in [Logging management events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-management-events-with-cloudtrail.html).

## References{% #references %}

- [Creating and updating a trail](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-create-and-update-a-trail.html)
- [Logging management events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-management-events-with-cloudtrail.html)
- [Receiving CloudTrail log files from multiple Regions](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/receive-cloudtrail-log-files-from-multiple-regions.html)
- [CIS Amazon Web Services Benchmarks](https://www.cisecurity.org/benchmark/amazon_web_services)