CloudTrail Must Log Data Events

Using Console

To remediate the CloudTrail Must Log Data Events misconfiguration for AWS using the AWS console, follow these steps:

Log in to the AWS Management Console.
Navigate to the CloudTrail service.
Select the trail that is not logging data events.
Click on the “Edit” button.
Scroll down to the “Data events” section.
Click on the “Add data event” button.
Select the AWS service(s) that you want to log data events for.
Select the specific data events that you want to log.
Click on the “Save” button to save the changes.

After completing these steps, CloudTrail will be configured to log data events for the selected AWS service(s) and specific data events.

Using CLI

To remediate the CloudTrail must log data events misconfiguration for AWS using AWS CLI, you can follow the below steps:

Open the AWS CLI on your local machine or EC2 instance.
Run the following command to check if CloudTrail is enabled:
aws cloudtrail describe-trails
If CloudTrail is not enabled, run the following command to create a trail:
aws cloudtrail create-trail --name <trail-name> --s3-bucket-name <bucket-name> --is-multi-region-trail
Replace <trail-name> with a name for your trail and <bucket-name> with the name of the S3 bucket where you want to store the log files.
Run the following command to update the trail to log data events:
aws cloudtrail update-trail --name <trail-name> --include-global-service-events --is-multi-region-trail
This command updates the trail to include global service events and enables multi-region logging.
Run the following command to start logging data events:
aws cloudtrail start-logging --name <trail-name>
This command starts logging data events to the specified trail.
Verify that data events are being logged by checking the S3 bucket for log files.

By following these steps, you can remediate the CloudTrail must log data events misconfiguration for AWS using AWS CLI.

Using Python

To remediate the misconfiguration “CloudTrail Must Log Data Events” in AWS using Python, you can follow the below steps:

Import the necessary libraries:

import boto3

Create a boto3 client for CloudTrail:

client = boto3.client('cloudtrail')

Get the current CloudTrail configuration:

response = client.get_trail(Name='my-trail')

Check if data events logging is enabled:

if not response['Trail']['IsMultiRegionTrail'] or not response['Trail']['IncludeGlobalServiceEvents'] or not response['Trail']['IsLogging']:
    # Data events logging is not enabled

Update the CloudTrail configuration to enable data events logging:

response = client.update_trail(
    Name='my-trail',
    IncludeGlobalServiceEvents=True,
    IsMultiRegionTrail=True,
    IsLogging=True,
    S3BucketName='my-bucket',
    S3KeyPrefix='my-prefix'
)

Verify that data events logging is enabled:

response = client.get_trail(Name='my-trail')
if response['Trail']['IsMultiRegionTrail'] and response['Trail']['IncludeGlobalServiceEvents'] and response['Trail']['IsLogging']:
    # Data events logging is enabled

Optionally, you can also create a CloudWatch alarm to monitor the CloudTrail logs for specific events:

cloudwatch = boto3.client('cloudwatch')
response = cloudwatch.put_metric_alarm(
    AlarmName='my-alarm',
    AlarmDescription='My alarm description',
    MetricName='NumberOfErrors',
    Namespace='AWS/CloudTrail',
    Statistic='Sum',
    Period=300,
    EvaluationPeriods=1,
    Threshold=1,
    ComparisonOperator='GreaterThanThreshold',
    AlarmActions=[
        'arn:aws:sns:us-east-1:123456789012:my-topic'
    ],
    Dimensions=[
        {
            'Name': 'TrailName',
            'Value': 'my-trail'
        }
    ]
)

By following these steps, you can remediate the “CloudTrail Must Log Data Events” misconfiguration in AWS using Python.

Using Terraform

resource "aws_cloudtrail" "TRAIL_RESOURCE_NAME" {
  name                          = "TRAIL_NAME"            # replace with your trail name
  s3_bucket_name                = "CLOUDTRAIL_BUCKET"     # replace with your CloudTrail destination bucket
  include_global_service_events = true
  is_multi_region_trail         = true
  enable_logging                = true

  # WARNING: This block overwrites all existing event selectors for the trail.
  # Manually merge any existing selectors you need to preserve before applying.
  event_selector {
    read_write_type           = "All"
    include_management_events = true

    data_resource {
      type   = "AWS::S3::Object"
      values = ["arn:aws:s3:::"] # logs S3 object-level data events for ALL buckets
      # To target specific buckets instead, use for example:
      # values = ["arn:aws:s3:::MY_CRITICAL_BUCKET/"]
    }
  }
}

This change updates the existing aws_cloudtrail trail in-place (no forced replacement), but it will replace any prior event_selector configuration on this resource, so merge carefully before applying. After updating, terraform plan should show an in-place update for aws_cloudtrail.TRAIL_RESOURCE_NAME with the new event_selector (ReadWriteType All, include_management_events = true, and data_resource for AWS::S3::Object with arn:aws:s3:::).

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

CloudTrail Must Log Data Events

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: