aws cloudtrail update-trail --name <trail-name> --enable-log-file-validation

aws cloudtrail describe-trails --trail-name-list <trail-name>

import boto3
from botocore.exceptions import ClientError

cloudtrail = boto3.client('cloudtrail')

try:
    response = cloudtrail.describe_trails()
    trails = response['trailList']
except ClientError as e:
    print("Error:", e)

for trail in trails:
    trail_name = trail['Name']
    try:
        response = cloudtrail.get_trail_status(Name=trail_name)
        log_file_validation_enabled = response['IsLogFileValidationEnabled']
    except ClientError as e:
        print("Error:", e)
    
    if not log_file_validation_enabled:
        # Enable file integrity validation for the trail
        try:
            cloudtrail.update_trail(Name=trail_name, EnableLogFileValidation=True)
            print("Enabled file integrity validation for trail:", trail_name)
        except ClientError as e:
            print("Error:", e)

resource "aws_cloudtrail" "THIS_TRAIL" {
  name                          = "CLOUDTRAIL_TRAIL_NAME" # replace with your trail name
  s3_bucket_name                = "CLOUDTRAIL_LOG_BUCKET_NAME" # replace with your S3 bucket
  enable_log_file_validation    = true

  # include any other existing arguments you already manage here, for example:
  # is_multi_region_trail       = true
  # kms_key_id                  = "KMS_KEY_ARN"
  # include_global_service_events = true
}