Skip to main content

More Info:

Your Amazon CloudTrail trail should be configured to use the appropriated S3 bucket in order to meet regulatory compliance requirements within your organization

Risk Level

Medium

Address

Security

Compliance Standards

  • APRA CPS 234 (Australia)
  • AWS Startup Security Baseline
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SOC2
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • StateRAMP
  • UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Using Console

To remediate the misconfiguration “CloudTrails Must Log Management Events” for AWS using the AWS console, follow these steps:
  1. Log in to the AWS Management Console and navigate to the CloudTrail service.
  2. Select the Trail that you want to modify and click on the “Edit” button.
  3. Scroll down to the “Management events” section and ensure that the “Read/Write events” checkbox is selected.
  4. Click on the “Save” button to save the changes.
  5. Repeat these steps for all the trails that you have configured in your AWS account.
By following these steps, you will ensure that CloudTrail logs all management events, including API calls made by users and services in your AWS account. This will help you to monitor and audit your AWS environment effectively and ensure compliance with your security policies.

To remediate the misconfiguration “CloudTrails Must Log Management Events” for AWS using AWS CLI, follow these steps:
  1. Open the AWS CLI on your local machine or on the AWS console.
  2. Run the following command to check if CloudTrail is enabled:
  3. If CloudTrail is not enabled, run the following command to create a new trail:
    Replace <trail-name> with the name you want to give to your trail and <bucket-name> with the name of the S3 bucket where you want to store your CloudTrail logs.
  4. Run the following command to update your trail to log management events:
  5. Finally, run the following command to enable your trail:
    This will start logging management events to your CloudTrail trail.
After following these steps, your CloudTrail will be enabled and configured to log management events.
To remediate the misconfiguration “CloudTrails Must Log Management Events” in AWS, you can use the following steps:
  1. Open the AWS Management Console and navigate to the CloudTrail service.
  2. Select the trail that you want to modify and click on the “Edit” button.
  3. In the “Management events” section, ensure that “Read/Write events” and “Data events” are selected.
  4. If “Data events” is not selected, click on the “Add data event” button and select the data events that you want to log.
  5. If you want to log all data events, select the “All data events” option.
  6. Click on the “Save” button to save the changes.
  7. Now, you can use the AWS SDK for Python (Boto3) to automate the remediation process. Here is the Python code to remediate the misconfiguration:
This code will update the specified trail to log management events. You can run this code for each trail that needs to be remediated.
Changing or adding event_selector / advanced_event_selector updates the existing trail in place and does not force replacement. Terraform plan should show either a new event_selector/advanced_event_selector block being added or an in-place update to these blocks on aws_cloudtrail.this, with include_management_events = true (basic) or field = "eventCategory", equals = ["Management"] (advanced).

Additional Reading: