AWS CloudTrail Security Controls

Implementing these controls

These controls are part of AWS Security Hub and either use AWS Config rules or custom Security Hub rules to monitor and enforce best practices. You can also set them up through a third-party system if you’d prefer. Step 1 is knowing what they are, and step 2 is implementing them.

How it works

Best Practices Checklist: [1]

[CloudTrail.1] CloudTrail should be enabled and configured with at least one multi-Region trail that includes read and write management events

Severity: High

Why:

Helps detect unexpected activity, even in unused regions
Ensure that AWS global services events are logged

Remediation:

Create a new trail / update an existing trail
In the Management Events, for API activity, make sure Read & Write are selected

[CloudTrail.2] CloudTrail should have encryption at-rest enabled

Severity: Medium

Why:

Checks whether CloudTrail is using SSE AWS KMS key encryption
This is an added layer of security for sensitive log files

Remediation:

Enable server-side encryption with AWS KMS keys (SSE-KMS) for encryption at rest

[CloudTrail.3] At least one CloudTrail trail should be enabled

Severity: High

Why:

Without visibility, you don’t have security
CloudTrail is the most critical AWS services to enable observability

Remediation:

Create a trail
Understand what’s enabled by default
Understand the difference between what gets collected and what doesn’t with Management Events, Data Events, and Insights Events

[CloudTrail.4] CloudTrail log file validation should be enabled

Severity: Low

Why:

Log file validation creates a digitally signed digest file with a hash of each log that CloudTrail writes to S3
If someone deletes or changes log files, validation would tell you

Remediation:

Enable log file validation on all trails

[CloudTrail.5] CloudTrail trails should be integrated with Amazon CloudWatch Logs

Severity: Medium

Why:

CloudTrail stores log files to S3, but they aren’t actionable on their own. You either need to download them or feed them into another tool like CloudWatch
Sending to CloudWatch helps with monitoring & alerting. It enables near real-time and historical analysis through simple searches and Logs insights

Remediation:

Send CloudTrail logs to CloudWatch Logs Group

[CloudTrail.6] Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible

Severity: Critical

Why:

Since CloudTrail sends log files to S3 with all sorts of API and non-API activity, that bucket will contain sensitive information

Remediation:

Ensure the S3 bucket blocks public access to the logs.
Set this up in a separate AWS account that blocks public access at the account level

[CloudTrail.7] Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket

Severity: Low

Why:

S3 bucket access logging generates records for each request made to your S3 bucket
This captures details including the request type, resources specified, and timestamp
This information is useful in security and incident response workflows

Remediation:

Enable server access logging for your CloudTrail S3 bucket

[CloudTrail.9] Trails should be tagged

Severity: Low

Why:

Tags help categorize resources by purpose, owner, environment, or other criteria
Enables attribute-based access control (ABAC) for permissions management
Supports tracking accountable resource owners for actions and notifications

Remediation:

Add required tags to CloudTrail trails
Follow tagging best practices as outlined in “Tagging your AWS resources” [2]

Use this cheat sheet with AI

Copy a ready-to-use prompt into your preferred AI assistant.

Goal

Preview prompt

Prompt

Use this Cybr cheat sheet as reference: AWS CloudTrail Security Controls
Source: https://cybr.com/cheat-sheets/cloudtrail-security-controls/

My goal: Review my setup

Help me review my CloudTrail configuration against these controls. Ask for my account and region coverage and relevant configuration. Work through the controls, identifying the evidence required, gaps, remediation, and how to verify the result. Mark controls with missing evidence as unknown rather than assuming they pass.

Use the included reference material even if you cannot open the source URL. Ask for missing context rather than inventing my environment. Explain assumptions. For version-sensitive service behavior or commands, consult current official documentation when available, cite it, and explain any differences from this reference. If you cannot verify something, say so.

Reference material from the cheat sheet (structured text or a curated summary):

{
  "title": "AWS CloudTrail Security Controls",
  "intro": "These controls are part of AWS Security Hub and either use AWS Config rules or custom Security Hub rules to monitor and enforce best practices. You can also set them up through a third-party system if you’d prefer. Step 1 is knowing what they are, and step 2 is implementing them.",
  "controls": [
    {
      "id": "CloudTrail.1",
      "title": "CloudTrail should be enabled and configured with at least one multi-Region trail that includes read and write management events",
      "severity": "High",
      "why": [
        "Helps detect unexpected activity, even in unused regions",
        "Ensure that AWS global services events are logged"
      ],
      "remediation": [
        "Create a new trail / update an existing trail",
        "In the Management Events, for API activity, make sure Read & Write are selected"
      ]
    },
    {
      "id": "CloudTrail.2",
      "title": "CloudTrail should have encryption at-rest enabled",
      "severity": "Medium",
      "why": [
        "Checks whether CloudTrail is using SSE AWS KMS key encryption",
        "This is an added layer of security for sensitive log files"
      ],
      "remediation": [
        "Enable server-side encryption with AWS KMS keys (SSE-KMS) for encryption at rest"
      ]
    },
    {
      "id": "CloudTrail.3",
      "title": "At least one CloudTrail trail should be enabled",
      "severity": "High",
      "why": [
        "Without visibility, you don’t have security",
        "CloudTrail is the most critical AWS services to enable observability"
      ],
      "remediation": [
        "Create a trail",
        "Understand what’s enabled by default",
        "Understand the difference between what gets collected and what doesn’t with Management Events, Data Events, and Insights Events"
      ]
    },
    {
      "id": "CloudTrail.4",
      "title": "CloudTrail log file validation should be enabled",
      "severity": "Low",
      "why": [
        "Log file validation creates a digitally signed digest file with a hash of each log that CloudTrail writes to S3",
        "If someone deletes or changes log files, validation would tell you"
      ],
      "remediation": [
        "Enable log file validation on all trails"
      ]
    },
    {
      "id": "CloudTrail.5",
      "title": "CloudTrail trails should be integrated with Amazon CloudWatch Logs",
      "severity": "Medium",
      "why": [
        "CloudTrail stores log files to S3, but they aren’t actionable on their own. You either need to download them or feed them into another tool like CloudWatch",
        "Sending to CloudWatch helps with monitoring & alerting. It enables near real-time and historical analysis through simple searches and Logs insights"
      ],
      "remediation": [
        "Send CloudTrail logs to CloudWatch Logs Group"
      ]
    },
    {
      "id": "CloudTrail.6",
      "title": "Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible",
      "severity": "Critical",
      "why": [
        "Since CloudTrail sends log files to S3 with all sorts of API and non-API activity, that bucket will contain sensitive information"
      ],
      "remediation": [
        "Ensure the S3 bucket blocks public access to the logs.",
        "Set this up in a separate AWS account that blocks public access at the account level"
      ]
    },
    {
      "id": "CloudTrail.7",
      "title": "Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket",
      "severity": "Low",
      "why": [
        "S3 bucket access logging generates records for each request made to your S3 bucket",
        "This captures details including the request type, resources specified, and timestamp",
        "This information is useful in security and incident response workflows"
      ],
      "remediation": [
        "Enable server access logging for your CloudTrail S3 bucket"
      ]
    },
    {
      "id": "CloudTrail.9",
      "title": "Trails should be tagged",
      "severity": "Low",
      "why": [
        "Tags help categorize resources by purpose, owner, environment, or other criteria",
        "Enables attribute-based access control (ABAC) for permissions management",
        "Supports tracking accountable resource owners for actions and notifications"
      ],
      "remediation": [
        "Add required tags to CloudTrail trails",
        "Follow tagging best practices as outlined in “Tagging your AWS resources” [2]"
      ]
    }
  ],
  "sources": [
    {
      "label": "[1] CloudTrail Controls",
      "href": "https://docs.aws.amazon.com/securityhub/latest/userguide/cloudtrail-controls.html"
    },
    {
      "label": "[2] Tagging your AWS resource",
      "href": "https://docs.aws.amazon.com/whitepapers/latest/tagging-best-practices/tagging-best-practices.html"
    }
  ],
  "course": {
    "label": "Learn how to use CloudTrail with our FREE course:",
    "href": "/courses/beginners-guide-to-aws-cloudtrail-for-security/"
  }
}

More cheat sheets