Control: CloudTrail trails should be integrated with CloudWatch logs
Description
Use AWS CloudWatch to centrally collect and manage log event activity. Inclusion of AWS CloudTrail data provides details of API call activity within your AWS account.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.cloudtrail_trail_integrated_with_logs
Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.cloudtrail_trail_integrated_with_logs --share
SQL
This control uses a named query:
select arn as resource, case when log_group_arn != 'null' and ((latest_delivery_time) > current_date - 1) then 'ok' else 'alarm' end as status, case when log_group_arn != 'null' and ((latest_delivery_time) > current_date - 1) then title || ' integrated with CloudWatch logs.' else title || ' not integrated with CloudWatch logs.' end as reason , region, account_idfrom aws_cloudtrail_trailwhere region = home_region;