Control: At least one enabled trail should be present in a region

Description

AWS CloudTrail can help in non-repudiation by recording AWS Management Console actions and API calls. You can identify the users and AWS accounts that called an AWS service, the source IP address where the calls generated, and the timings of the calls. Details of captured data are seen within AWS CloudTrail Record Contents.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.cloudtrail_trail_enabled

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.cloudtrail_trail_enabled --share

SQL

This control uses a named query:

with trails_enabled as (
  select
    arn,
    is_logging
  from
    aws_cloudtrail_trail
  where
    home_region = region
)
select
  a.arn as resource,
  case
    when b.is_logging is null and a.is_logging then 'ok'
    when b.is_logging then 'ok'
    else 'alarm'
  end as status,
  case
    when b.is_logging is null and a.is_logging then a.title || ' enabled.'
    when b.is_logging then a.title || ' enabled.'
    else a.title || ' disabled.'
  end as reason
  
  , a.region, a.account_id
from
  aws_cloudtrail_trail as a
  left join trails_enabled b on a.arn = b.arn;

Control: At least one enabled trail should be present in a region

Description

Usage

SQL

Tags