---
title: "AWS CloudTrail Security Controls Cheat Sheet | Cybr"
description: "Best Practices Checklist"
url: https://cybr.com/cheat-sheets/cloudtrail-security-controls/
---

# AWS CloudTrail Security Controls

![AWS CloudTrail](https://cybr.com/aws-security-services/icons/Arch_AWS-CloudTrail_64.svg)

![Christophe Limpalair](https://cybr.com/cloud-attack-simulations/christophe.png) [**Cybr**](https://cybr.com/)

[cybr.com ↗](https://cybr.com/) [Christophe Limpalair ↗](https://www.linkedin.com/in/christophelimpalair/)

## Implementing these controls

These controls are part of AWS Security Hub and either use AWS Config rules or custom Security Hub rules to monitor and enforce best practices. You can also set them up through a third-party system if you’d prefer. Step 1 is knowing what they are, and step 2 is implementing them.

**How it works**

## Best Practices Checklist: \[1\]

### \[CloudTrail.1\] CloudTrail should be enabled and configured with at least one multi-Region trail that includes read and write management events

**Severity:** High

**Why:**

- Helps detect unexpected activity, even in unused regions
- Ensure that AWS global services events are logged

**Remediation:**

- Create a new trail / update an existing trail
- In the Management Events, for API activity, make sure Read & Write are selected

### \[CloudTrail.2\] CloudTrail should have encryption at-rest enabled

**Severity:** Medium

**Why:**

- Checks whether CloudTrail is using SSE AWS KMS key encryption
- This is an added layer of security for sensitive log files

**Remediation:**

- Enable server-side encryption with AWS KMS keys (SSE-KMS) for encryption at rest

### \[CloudTrail.3\] At least one CloudTrail trail should be enabled

**Severity:** High

**Why:**

- Without visibility, you don’t have security
- CloudTrail is the most critical AWS services to enable observability

**Remediation:**

- Create a trail
- Understand what’s enabled by default
- Understand the difference between what gets collected and what doesn’t with Management Events, Data Events, and Insights Events

### \[CloudTrail.4\] CloudTrail log file validation should be enabled

**Severity:** Low

**Why:**

- Log file validation creates a digitally signed digest file with a hash of each log that CloudTrail writes to S3
- If someone deletes or changes log files, validation would tell you

**Remediation:**

- Enable log file validation on all trails

### \[CloudTrail.5\] CloudTrail trails should be integrated with Amazon CloudWatch Logs

**Severity:** Medium

**Why:**

- CloudTrail stores log files to S3, but they aren’t actionable on their own. You either need to download them or feed them into another tool like CloudWatch
- Sending to CloudWatch helps with monitoring & alerting. It enables near real-time and historical analysis through simple searches and Logs insights

**Remediation:**

- Send CloudTrail logs to CloudWatch Logs Group

### \[CloudTrail.6\] Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible

**Severity:** Critical

**Why:**

- Since CloudTrail sends log files to S3 with all sorts of API and non-API activity, that bucket will contain sensitive information

**Remediation:**

- Ensure the S3 bucket blocks public access to the logs.
- Set this up in a separate AWS account that blocks public access at the account level

### \[CloudTrail.7\] Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket

**Severity:** Low

**Why:**

- S3 bucket access logging generates records for each request made to your S3 bucket
- This captures details including the request type, resources specified, and timestamp
- This information is useful in security and incident response workflows

**Remediation:**

- Enable server access logging for your CloudTrail S3 bucket

### \[CloudTrail.9\] Trails should be tagged

**Severity:** Low

**Why:**

- Tags help categorize resources by purpose, owner, environment, or other criteria
- Enables attribute-based access control (ABAC) for permissions management
- Supports tracking accountable resource owners for actions and notifications

**Remediation:**

- Add required tags to CloudTrail trails
- Follow tagging best practices as outlined in “Tagging your AWS resources” \[2\]

## Use this cheat sheet with AI

Copy a ready-to-use prompt into your preferred AI assistant.

Goal

Preview prompt

Prompt

Sources and more info:[\[1\] CloudTrail Controls ↗](https://docs.aws.amazon.com/securityhub/latest/userguide/cloudtrail-controls.html)[\[2\] Tagging your AWS resource ↗](https://docs.aws.amazon.com/whitepapers/latest/tagging-best-practices/tagging-best-practices.html)

[Learn how to use CloudTrail with our FREE course: ↗](https://cybr.com/courses/beginners-guide-to-aws-cloudtrail-for-security/) [](https://cybr.com/)

[More cheat sheets](https://cybr.com/cheat-sheets/)