Project: KICS (Provisioning / Security & Compliance)
File: 65d07da5-9af5-44df-8983-52d2e6f24c44.md

title: CloudTrail Not Integrated With CloudWatch hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 65d07da5-9af5-44df-8983-52d2e6f24c44 Query name: CloudTrail Not Integrated With CloudWatch Platform: CloudFormation Severity: <span style="color:#edd57e">Low</span> Category: Observability URL: CloudTrail should be integrated with CloudWatch<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="62" AWSTemplateFormatVersion: "2010-09-09" Parameters: OperatorEmail: Description: "Email address to notify when new logs are published." Type: String Resources: S3Bucket: DeletionPolicy: Retain Type: AWS::S3::Bucket Properties: {} BucketPolicy: Type: AWS::S3::BucketPolicy Properties: Bucket: Ref: S3Bucket PolicyDocument: Version: "2012-10-17" Statement: Sid: "AWSCloudTrailAclCheck" Effect: "Allow" Principal: Service: "cloudtrail.amazonaws.com" Action: "s3:GetBucketAcl" Resource: !Sub |- arn:aws:s3:::${S3Bucket} Sid: "AWSCloudTrailWrite" Effect: "Allow" Principal: Service: "cloudtrail.amazonaws.com" Action: "s3:PutObject" Resource: !Sub |- arn:aws:s3:::${S3Bucket}/AWSLogs/${AWS::AccountId}/* Condition: StringEquals: s3:x-amz-acl: "bucket-owner-full-control" Topic: Type: AWS::SNS::Topic Properties: Subscription: Endpoint: Ref: OperatorEmail Protocol: email TopicPolicy: Type: AWS::SNS::TopicPolicy Properties: Topics: Ref: "Topic" PolicyDocument: Version: "2008-10-17" Statement: Sid: "AWSCloudTrailSNSPolicy" Effect: "Allow" Principal: Service: "cloudtrail.amazonaws.com" Resource: "*" Action: "SNS:Publish" myTrail: DependsOn: BucketPolicy TopicPolicy Type: AWS::CloudTrail::Trail Properties: S3BucketName: Ref: S3Bucket SnsTopicName: Fn::GetAtt: Topic TopicName IsLogging: true IsMultiRegionTrail: true ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="62" AWSTemplateFormatVersion: "2010-09-09" Parameters: OperatorEmail: Description: "Email address to notify when new logs are published." Type: String Resources: S3Bucket: DeletionPolicy: Retain Type: AWS::S3::Bucket Properties: {} BucketPolicy: Type: AWS::S3::BucketPolicy Properties: Bucket: Ref: S3Bucket PolicyDocument: Version: "2012-10-17" Statement: Sid: "AWSCloudTrailAclCheck" Effect: "Allow" Principal: Service: "cloudtrail.amazonaws.com" Action: "s3:GetBucketAcl" Resource: !Sub |- arn:aws:s3:::${S3Bucket} Sid: "AWSCloudTrailWrite" Effect: "Allow" Principal: Service: "cloudtrail.amazonaws.com" Action: "s3:PutObject" Resource: !Sub |- arn:aws:s3:::${S3Bucket}/AWSLogs/${AWS::AccountId}/* Condition: StringEquals: s3:x-amz-acl: "bucket-owner-full-control" Topic: Type: AWS::SNS::Topic Properties: Subscription: Endpoint: Ref: OperatorEmail Protocol: email TopicPolicy: Type: AWS::SNS::TopicPolicy Properties: Topics: Ref: "Topic" PolicyDocument: Version: "2008-10-17" Statement: Sid: "AWSCloudTrailSNSPolicy" Effect: "Allow" Principal: Service: "cloudtrail.amazonaws.com" Resource: "*" Action: "SNS:Publish" myTrail2: DependsOn: BucketPolicy TopicPolicy Type: AWS::CloudTrail::Trail Properties: CloudWatchLogsRoleArn: "Fn::GetAtt": IamRoleForCwLogs Arn S3BucketName: Ref: S3Bucket SnsTopicName: Fn::GetAtt: Topic TopicName IsLogging: true IsMultiRegionTrail: true IamRoleForCwLogs: Type: "AWS::IAM::Role" Properties: AssumeRolePolicyDocument: Version: "2012-10-17" Statement: Sid: "" Effect: Allow Principal: Service: cloudtrail.amazonaws.com Action: "sts:AssumeRole" Policies: PolicyName: allow-access-to-cw-logs PolicyDocument: Version: "2012-10-17" Statement: Effect: Allow Action: "logs:CreateLogStream" "logs:PutLogEvents" Resource: "*" ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="62" AWSTemplateFormatVersion: "2010-09-09" Parameters: OperatorEmail: Description: "Email address to notify when new logs are published." Type: String Resources: S3Bucket: DeletionPolicy: Retain Type: AWS::S3::Bucket Properties: {} BucketPolicy: Type: AWS::S3::BucketPolicy Properties: Bucket: Ref: S3Bucket PolicyDocument: Version: "2012-10-17" Statement: Sid: "AWSCloudTrailAclCheck" Effect: "Allow" Principal: Service: "cloudtrail.amazonaws.com" Action: "s3:GetBucketAcl" Resource: !Sub |- arn:aws:s3:::${S3Bucket} Sid: "AWSCloudTrailWrite" Effect: "Allow" Principal: Service: "cloudtrail.amazonaws.com" Action: "s3:PutObject" Resource: !Sub |- arn:aws:s3:::${S3Bucket}/AWSLogs/${AWS::AccountId}/* Condition: StringEquals: s3:x-amz-acl: "bucket-owner-full-control" Topic: Type: AWS::SNS::Topic Properties: Subscription: Endpoint: Ref: OperatorEmail Protocol: email TopicPolicy: Type: AWS::SNS::TopicPolicy Properties: Topics: Ref: "Topic" PolicyDocument: Version: "2008-10-17" Statement: Sid: "AWSCloudTrailSNSPolicy" Effect: "Allow" Principal: Service: "cloudtrail.amazonaws.com" Resource: "*" Action: "SNS:Publish" myTrail3: DependsOn: BucketPolicy TopicPolicy Type: AWS::CloudTrail::Trail Properties: CloudWatchLogsLogGroupArn: "arn:aws:logs:us-west-2:920172477660:log-group:CloudTrail/DefaultLogGroup:*" S3BucketName: Ref: S3Bucket SnsTopicName: Fn::GetAtt: Topic TopicName IsLogging: true IsMultiRegionTrail: true IamRoleForCwLogs: Type: "AWS::IAM::Role" Properties: AssumeRolePolicyDocument: Version: "2012-10-17" Statement: Sid: "" Effect: Allow Principal: Service: cloudtrail.amazonaws.com Action: "sts:AssumeRole" Policies: PolicyName: allow-access-to-cw-logs PolicyDocument: Version: "2012-10-17" Statement: Effect: Allow Action: "logs:CreateLogStream" "logs:PutLogEvents" Resource: "*" ``` <details><summary>Positive test

4 - json file</summary> ```json hl_lines="82" { "Resources": { "S3Bucket": { "DeletionPolicy": "Retain", "Type": "AWS::S3::Bucket", "Properties": {} }, "BucketPolicy": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "S3Bucket" }, "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSCloudTrailAclCheck", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Action": "s3:GetBucketAcl", "Resource": "arn:aws:s3:::${S3Bucket}" }, { "Sid": "AWSCloudTrailWrite", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Action": "s3:PutObject", "Resource": "arn:aws:s3:::${S3Bucket}/AWSLogs/${AWS::AccountId}/*", "Condition": { "StringEquals": { "s3:x-amz-acl": "bucket-owner-full-control" } } } ] } } }, "Topic": { "Type": "AWS::SNS::Topic", "Properties": { "Subscription": [ { "Endpoint": { "Ref": "OperatorEmail" }, "Protocol": "email" } ] } }, "TopicPolicy": { "Type": "AWS::SNS::TopicPolicy", "Properties": { "Topics": [ { "Ref": "Topic" } ], "PolicyDocument": { "Statement": [ { "Sid": "AWSCloudTrailSNSPolicy", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Resource": "*", "Action": "SNS:Publish" } ], "Version": "2008-10-17" } } }, "myTrail": { "Properties": { "IsMultiRegionTrail": true, "S3BucketName": { "Ref": "S3Bucket" }, "SnsTopicName": { "Fn::GetAtt": [ "Topic", "TopicName" ] }, "IsLogging": true }, "DependsOn": [ "BucketPolicy", "TopicPolicy" ], "Type": "AWS::CloudTrail::Trail" } }, "AWSTemplateFormatVersion": "2010-09-09", "Parameters": { "OperatorEmail": { "Description": "Email address to notify when new logs are published.", "Type": "String" } } } ``` </details> <details><summary>Positive test num. 5 - json file</summary> ```json hl_lines="82" { "Resources": { "S3Bucket": { "DeletionPolicy": "Retain", "Type": "AWS::S3::Bucket", "Properties": {} }, "BucketPolicy": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "S3Bucket" }, "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSCloudTrailAclCheck", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Action": "s3:GetBucketAcl", "Resource": "arn:aws:s3:::${S3Bucket}" }, { "Sid": "AWSCloudTrailWrite", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Action": "s3:PutObject", "Resource": "arn:aws:s3:::${S3Bucket}/AWSLogs/${AWS::AccountId}/*", "Condition": { "StringEquals": { "s3:x-amz-acl": "bucket-owner-full-control" } } } ] } } }, "Topic": { "Type": "AWS::SNS::Topic", "Properties": { "Subscription": [ { "Endpoint": { "Ref": "OperatorEmail" }, "Protocol": "email" } ] } }, "TopicPolicy": { "Type": "AWS::SNS::TopicPolicy", "Properties": { "Topics": [ { "Ref": "Topic" } ], "PolicyDocument": { "Statement": [ { "Sid": "AWSCloudTrailSNSPolicy", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Resource": "*", "Action": "SNS:Publish" } ], "Version": "2008-10-17" } } }, "myTrail": { "Properties": { "IsMultiRegionTrail": true, "CloudWatchLogsRoleArn": { "Fn::GetAtt": [ "IamRoleForCwLogs", "Arn" ] }, "S3BucketName": { "Ref": "S3Bucket" }, "SnsTopicName": { "Fn::GetAtt": [ "Topic", "TopicName" ] }, "IsLogging": true }, "DependsOn": [ "BucketPolicy", "TopicPolicy" ], "Type": "AWS::CloudTrail::Trail" } }, "AWSTemplateFormatVersion": "2010-09-09", "Parameters": { "OperatorEmail": { "Description": "Email address to notify when new logs are published.", "Type": "String" } } } ``` </details> <details><summary>Positive test num. 6 - json file</summary> ```json hl_lines="82" { "Resources": { "S3Bucket": { "DeletionPolicy": "Retain", "Type": "AWS::S3::Bucket", "Properties": {} }, "BucketPolicy": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "S3Bucket" }, "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSCloudTrailAclCheck", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Action": "s3:GetBucketAcl", "Resource": "arn:aws:s3:::${S3Bucket}" }, { "Sid": "AWSCloudTrailWrite", "Effect": "Allow", "Principal": { "Service":

}, "Action": "s3:PutObject", "Resource": "arn:aws:s3:::${S3Bucket}/AWSLogs/${AWS::AccountId}/*", "Condition": { "StringEquals": { "s3:x-amz-acl": "bucket-owner-full-control" } } } ] } } }, "Topic": { "Type": "AWS::SNS::Topic", "Properties": { "Subscription": [ { "Endpoint": { "Ref": "OperatorEmail" }, "Protocol": "email" } ] } }, "TopicPolicy": { "Type": "AWS::SNS::TopicPolicy", "Properties": { "Topics": [ { "Ref": "Topic" } ], "PolicyDocument": { "Statement": [ { "Sid": "AWSCloudTrailSNSPolicy", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Resource": "*", "Action": "SNS:Publish" } ], "Version": "2008-10-17" } } }, "myTrail": { "Properties": { "IsMultiRegionTrail": true, "CloudWatchLogsLogGroupArn": "arn:aws:logs:us-west-2:920172477660:log-group:CloudTrail/DefaultLogGroup:*", "S3BucketName": { "Ref": "S3Bucket" }, "SnsTopicName": { "Fn::GetAtt": [ "Topic", "TopicName" ] }, "IsLogging": true }, "DependsOn": [ "BucketPolicy", "TopicPolicy" ], "Type": "AWS::CloudTrail::Trail" } }, "AWSTemplateFormatVersion": "2010-09-09", "Parameters": { "OperatorEmail": { "Description": "Email address to notify when new logs are published.", "Type": "String" } } } ``` </details> ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: "2010-09-09" Parameters: OperatorEmail: Description: "Email address to notify when new logs are published." Type: String Resources: S3Bucket: DeletionPolicy: Retain Type: AWS::S3::Bucket Properties: {} BucketPolicy: Type: AWS::S3::BucketPolicy Properties: Bucket: Ref: S3Bucket PolicyDocument: Version: "2012-10-17" Statement: Sid: "AWSCloudTrailAclCheck" Effect: "Allow" Principal: Service: "cloudtrail.amazonaws.com" Action: "s3:GetBucketAcl" Resource: !Sub |- arn:aws:s3:::${S3Bucket} Sid: "AWSCloudTrailWrite" Effect: "Allow" Principal: Service: "cloudtrail.amazonaws.com" Action: "s3:PutObject" Resource: !Sub |- arn:aws:s3:::${S3Bucket}/AWSLogs/${AWS::AccountId}/* Condition: StringEquals: s3:x-amz-acl: "bucket-owner-full-control" Topic: Type: AWS::SNS::Topic Properties: Subscription: Endpoint: Ref: OperatorEmail Protocol: email TopicPolicy: Type: AWS::SNS::TopicPolicy Properties: Topics: Ref: "Topic" PolicyDocument: Version: "2008-10-17" Statement: Sid: "AWSCloudTrailSNSPolicy" Effect: "Allow" Principal: Service: "cloudtrail.amazonaws.com" Resource: "*" Action: "SNS:Publish" myTrail: DependsOn: BucketPolicy TopicPolicy Type: AWS::CloudTrail::Trail Properties: CloudWatchLogsLogGroupArn: "arn:aws:logs:us-west-2:920172477660:log-group:CloudTrail/DefaultLogGroup:*" CloudWatchLogsRoleArn: "Fn::GetAtt": IamRoleForCwLogs Arn S3BucketName: Ref: S3Bucket SnsTopicName: Fn::GetAtt: Topic TopicName IsLogging: true IsMultiRegionTrail: true IamRoleForCwLogs: Type: "AWS::IAM::Role" Properties: AssumeRolePolicyDocument: Version: "2012-10-17" Statement: Sid: "" Effect: Allow Principal: Service: cloudtrail.amazonaws.com Action: "sts:AssumeRole" Policies: PolicyName: allow-access-to-cw-logs PolicyDocument: Version: "2012-10-17" Statement: Effect: Allow Action: "logs:CreateLogStream" "logs:PutLogEvents" Resource: "*" ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09", "Parameters": { "OperatorEmail": { "Description": "Email address to notify when new logs are published.", "Type": "String" } }, "Resources": { "S3Bucket": { "DeletionPolicy": "Retain", "Type": "AWS::S3::Bucket", "Properties": {} }, "BucketPolicy": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "S3Bucket" }, "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSCloudTrailAclCheck", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Action": "s3:GetBucketAcl", "Resource": "value" }, { "Sid": "AWSCloudTrailWrite", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Action": "s3:PutObject", "Resource": "value", "Condition": { "StringEquals": { "s3:x-amz-acl": "bucket-owner-full-control" } } } ] } } }, "Topic": { "Type": "AWS::SNS::Topic", "Properties": { "Subscription": [ { "Endpoint": { "Ref": "OperatorEmail" }, "Protocol": "email" } ] } }, "TopicPolicy": { "Type": "AWS::SNS::TopicPolicy", "Properties": { "Topics": [ { "Ref": "Topic" } ], "PolicyDocument": { "Version": "2008-10-17", "Statement": [ { "Sid": "AWSCloudTrailSNSPolicy", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Resource": "*", "Action": "SNS:Publish" } ] } } }, "myTrail": { "DependsOn": [ "BucketPolicy", "TopicPolicy" ], "Type": "AWS::CloudTrail::Trail", "Properties": { "CloudWatchLogsLogGroupArn": "arn:aws:logs:us-west-2:920172477660:log-group:CloudTrail/DefaultLogGroup:*", "CloudWatchLogsRoleArn": { "Fn::GetAtt": [ "IamRoleForCwLogs", "Arn" ] }, "S3BucketName": { "Ref": "S3Bucket" }, "SnsTopicName": { "Fn::GetAtt": [ "Topic", "TopicName" ] }, "IsLogging": true, "IsMultiRegionTrail": true } }, "IamRoleForCwLogs": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Sid": "", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Action": "sts:AssumeRole" } ] }, "Policies": [ { "PolicyName": "allow-access-to-cw-logs", "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "*" } ] } } ] } } } } ```