Project: KICS (Provisioning / Security & Compliance)
File: 17b30f8f-8dfb-4597-adf6-57600b6cf25e.md

title: CloudTrail Not Integrated With CloudWatch hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 17b30f8f-8dfb-4597-adf6-57600b6cf25e Query name: CloudTrail Not Integrated With CloudWatch Platform: Terraform Severity: <span style="color:#edd57e">Low</span> Category: Observability URL: CloudTrail should be integrated with CloudWatch<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "aws_cloudtrail" "positive1" { name = "tf-trail-foobar" s3bucketname = awss3bucket.foo.id s3keyprefix = "prefix" includeglobalservice_events = false } data "awscalleridentity" "current" {} resource "awss3bucket" "positive4" { bucket = "tf-test-trail" force_destroy = true policy = <<POLICY { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSCloudTrailAclCheck", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Action": "s3:GetBucketAcl", "Resource": "arn:aws:s3:::tf-test-trail" }, { "Sid": "AWSCloudTrailWrite", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Action": "s3:PutObject", "Resource": "arn:aws:s3:::tf-test-trail/prefix/AWSLogs/${data.awscalleridentity.current.account_id}/*", "Condition": { "StringEquals": { "s3:x-amz-acl": "bucket-owner-full-control" } } } ] } POLICY } ``` ```tf title="Negative test num. 1 - tf file" resource "awscloudwatchloggroup" "cloudtraillog_group" { name = "aws-foundations-benchmark-1-4-0-terraform-3-4-remediated" } resource "awsiamrole" "cloudwatchlogs_role" { name = "aws-foundations-benchmark-1-4-0-terraform-3-4-remediated" assumerolepolicy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Sid": "", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Action": "sts:AssumeRole" } ] } EOF } resource "awsiamrolepolicy" "cloudwatch_policy" { name = "CloudWatch-policy" role = awsiamrole.cloudwatchlogs_role.id policy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:CreateLogStream" ], "Resource": [ "${awscloudwatchloggroup.cloudtraillog_group.arn}:*" ] }, { "Effect": "Allow", "Action": [ "logs:PutLogEvents" ], "Resource": [ "${awscloudwatchloggroup.cloudtraillog_group.arn}:*" ] } ] } EOF } data "awscalleridentity" "current" {} resource "aws_cloudtrail" "negative1" { name = "tf-trail-foobar" s3bucketname = awss3bucket.foo.id s3keyprefix = "prefix" includeglobalservice_events = false cloudwatchlogsgrouparn = "${awscloudwatchloggroup.cloudtraillog_group.arn}:*" cloudwatchlogsrolearn = awsiamrole.cloudwatchlogs_role.arn } resource "awss3bucket" "negative2" { bucket = "tf-test-trail" force_destroy = true policy = <<POLICY { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSCloudTrailAclCheck", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Action": "s3:GetBucketAcl", "Resource": "arn:aws:s3:::tf-test-trail" }, { "Sid": "AWSCloudTrailWrite", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Action": "s3:PutObject", "Resource": "arn:aws:s3:::tf-test-trail/prefix/AWSLogs/${data.awscalleridentity.current.account_id}/*", "Condition": { "StringEquals": { "s3:x-amz-acl": "bucket-owner-full-control" } } } ] } POLICY } ```