Control: Ensure CloudTrail is enabled in all regions

Description

CloudTrail is a service that records AWS API calls for your account and delivers log files to you. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service.

Usage

Run the control in your terminal:

powerpipe control run terraform_aws_compliance.control.cloudtrail_enabled_all_regions

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run terraform_aws_compliance.control.cloudtrail_enabled_all_regions --share

SQL

This control uses a named query:

select
  address as resource,
  case
    when (attributes_std ->> 'is_multi_region_trail') is null or (attributes_std ->> 'is_multi_region_trail')::boolean = 'false' then 'alarm'
    when (attributes_std ->> 'enable_logging') is null or (attributes_std ->> 'enable_logging')::boolean = 'false' then 'alarm'
    when (attributes_std -> 'event_selector' ->> 'read_write_type')::text <> 'All' then 'alarm'
    else 'ok'
  end status,
  split_part(address, '.', 2) || case
    when (attributes_std ->> 'is_multi_region_trail') is null or (attributes_std ->> 'is_multi_region_trail')::boolean = 'false' then ' multi region trails not enabled'
    when (attributes_std ->> 'enable_logging') is null or (attributes_std ->> 'enable_logging')::boolean = 'false' then ' logging disabled'
    when (attributes_std -> 'event_selector' ->> 'read_write_type')::text <> 'All' then ' not enbaled for all events'
    else ' logging enabled for ALL events'
  end || '.' reason
  
  , path || ':' || start_line
from
  terraform_resource
where
  type = 'aws_cloudtrail';

Control: Ensure CloudTrail is enabled in all regions

Description

Usage

SQL

Tags