Cloudtrail global services enabled remediation

Using Console

To remediate the misconfiguration “Trails Should Record Both Regional And Global Events” for AWS using AWS console, you can follow these steps:

Open the AWS Management Console and navigate to the CloudTrail service.
Select the trail that you want to update.
Click on the “Edit” button.
In the “Event selectors” section, make sure that “All” is selected under “Data events”.
Under “Management events”, select “Global services” and “Regional services”.
Click on the “Save” button to save the changes.
Verify that the trail is now recording both regional and global events by checking the “Event history” tab for the trail.

By following these steps, you can remediate the misconfiguration “Trails Should Record Both Regional And Global Events” for AWS using AWS console.

Using CLI

To remediate this misconfiguration in AWS using AWS CLI, follow these steps:

Open your terminal or command prompt and ensure that you have AWS CLI installed and configured with your AWS account credentials.
Run the following command to create a trail with the required settings:

aws cloudtrail create-trail --name <trail-name> --s3-bucket-name <bucket-name> --include-global-service-events

Replace <trail-name> with a name for your trail and <bucket-name> with the name of the S3 bucket where you want to store your trail logs.

If you already have a trail created, you can update it to include global service events using the following command:

aws cloudtrail update-trail --name <trail-name> --include-global-service-events

Replace <trail-name> with the name of your existing trail.

Verify that your trail is recording both regional and global events by running the following command:

aws cloudtrail describe-trails --trail-name-list <trail-name>

This command will return the details of your trail, including the settings for recording regional and global events.By following these steps, you will have remediated the misconfiguration and ensured that your AWS trail is recording both regional and global events.

Using Python

To remediate the misconfiguration “Trails Should Record Both Regional And Global Events” for AWS using Python, you can follow the below steps:

Open the AWS Management Console and navigate to the CloudTrail service.
Select the trail that needs to be updated and click on “Edit”.
In the “Event selectors” section, click on “Add event selector”.
In the “Create event selector” page, select “All events” under “Event selector type”.
Select the regions for which you want to record events. You can select individual regions or select “All regions” to record events from all regions.
Select “Global services” to record events from global services.
Click on “Add event selector” to save the changes.
To automate this process using Python, you can use the AWS SDK for Python (Boto3).
Install Boto3 using the command “pip install boto3”.
Write a Python script that uses the Boto3 library to update the CloudTrail trail.
Use the “update_trail” method of the “cloudtrail” client to update the trail.
Set the “IncludeGlobalServiceEvents” parameter to “True” to record events from global services.
Set the “EventSelectors” parameter to include all regions.
Save the script and run it to update the trail.

Here is a sample code to update a CloudTrail trail using Python and Boto3:

import boto3

# Create a CloudTrail client
client = boto3.client('cloudtrail')

# Update the trail
response = client.update_trail(
    Name='my-trail',
    IncludeGlobalServiceEvents=True,
    EventSelectors=[
        {
            'ReadWriteType': 'All',
            'IncludeManagementEvents': True,
            'DataResources': [
                {
                    'Type': 'AWS::S3::Object',
                    'Values': [
                        'arn:aws:s3:::my-bucket/*'
                    ]
                }
            ]
        }
    ]
)

# Print the response
print(response)

Note: Replace “my-trail” with the name of your trail and “my-bucket” with the name of your S3 bucket. Also, modify the “EventSelectors” parameter to include all regions.

Using Terraform

resource "aws_cloudtrail" "THIS_TRAIL" {
  name                          = "TRAIL_NAME"                # replace with your trail name
  s3_bucket_name                = "CLOUDTRAIL_BUCKET_NAME"    # replace with your CloudTrail S3 bucket
  include_global_service_events = true                        # ensure global service events are logged

  # keep any other existing arguments you already use,
  # such as is_multi_region_trail, kms_key_id, etc.
}

This change does not force replacement of the trail; Terraform will update the existing CloudTrail configuration in place.Verification: terraform plan should show an in-place update of the aws_cloudtrail.THIS_TRAIL resource with include_global_service_events changing from false (or unset) to true.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Cloudtrail global services enabled remediation

Triage and Remediation

Remediation

​Triage and Remediation

​Remediation

​

Triage and Remediation

Remediation