Skip to main content

More Info:

Your CloudTrail trails should be recording both regional and global events in order to increase the visibility of the API activity in your AWS account for security and management purposes.

Risk Level

Medium

Address

Security

Compliance Standards

  • APRA CPS 234 (Australia)
  • AWS Well Architected Framework
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • GDPR
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • PCI
  • Reserve Bank of India (RBI) Cyber Security Framework
  • Reserve Bank of India (RBI) Master Direction – Information Technology Framework
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • StateRAMP
  • UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Using Console

To remediate the misconfiguration “Trails Should Record Both Regional And Global Events” for AWS using AWS console, you can follow these steps:
  1. Open the AWS Management Console and navigate to the CloudTrail service.
  2. Select the trail that you want to update.
  3. Click on the “Edit” button.
  4. In the “Event selectors” section, make sure that “All” is selected under “Data events”.
  5. Under “Management events”, select “Global services” and “Regional services”.
  6. Click on the “Save” button to save the changes.
  7. Verify that the trail is now recording both regional and global events by checking the “Event history” tab for the trail.
By following these steps, you can remediate the misconfiguration “Trails Should Record Both Regional And Global Events” for AWS using AWS console.

To remediate this misconfiguration in AWS using AWS CLI, follow these steps:
  1. Open your terminal or command prompt and ensure that you have AWS CLI installed and configured with your AWS account credentials.
  2. Run the following command to create a trail with the required settings:
Replace <trail-name> with a name for your trail and <bucket-name> with the name of the S3 bucket where you want to store your trail logs.
  1. If you already have a trail created, you can update it to include global service events using the following command:
Replace <trail-name> with the name of your existing trail.
  1. Verify that your trail is recording both regional and global events by running the following command:
This command will return the details of your trail, including the settings for recording regional and global events.By following these steps, you will have remediated the misconfiguration and ensured that your AWS trail is recording both regional and global events.
To remediate the misconfiguration “Trails Should Record Both Regional And Global Events” for AWS using Python, you can follow the below steps:
  1. Open the AWS Management Console and navigate to the CloudTrail service.
  2. Select the trail that needs to be updated and click on “Edit”.
  3. In the “Event selectors” section, click on “Add event selector”.
  4. In the “Create event selector” page, select “All events” under “Event selector type”.
  5. Select the regions for which you want to record events. You can select individual regions or select “All regions” to record events from all regions.
  6. Select “Global services” to record events from global services.
  7. Click on “Add event selector” to save the changes.
  8. To automate this process using Python, you can use the AWS SDK for Python (Boto3).
  9. Install Boto3 using the command “pip install boto3”.
  10. Write a Python script that uses the Boto3 library to update the CloudTrail trail.
  11. Use the “update_trail” method of the “cloudtrail” client to update the trail.
  12. Set the “IncludeGlobalServiceEvents” parameter to “True” to record events from global services.
  13. Set the “EventSelectors” parameter to include all regions.
  14. Save the script and run it to update the trail.
Here is a sample code to update a CloudTrail trail using Python and Boto3:
Note: Replace “my-trail” with the name of your trail and “my-bucket” with the name of your S3 bucket. Also, modify the “EventSelectors” parameter to include all regions.
This change does not force replacement of the trail; Terraform will update the existing CloudTrail configuration in place.Verification: terraform plan should show an in-place update of the aws_cloudtrail.THIS_TRAIL resource with include_global_service_events changing from false (or unset) to true.

Additional Reading: