Project: KICS (Provisioning / Security & Compliance)
File: 058ac855-989f-4378-ba4d-52d004020da7.md

title: CloudTrail Multi Region Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 058ac855-989f-4378-ba4d-52d004020da7 Query name: CloudTrail Multi Region Disabled Platform: CloudFormation Severity: <span style="color:#edd57e">Low</span> Category: Observability URL: CloudTrail multi region should be enabled, which means attribute 'IsMultiRegionTrail' should be set to true<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="76 70" AWSTemplateFormatVersion: "2010-09-09" Parameters: OperatorEmail: Description: "Email address to notify when new logs are published." Type: String Resources: S3Bucket: DeletionPolicy: Retain Type: AWS::S3::Bucket Properties: {} BucketPolicy: Type: AWS::S3::BucketPolicy Properties: Bucket: Ref: S3Bucket PolicyDocument: Version: "2012-10-17" Statement: Sid: "AWSCloudTrailAclCheck" Effect: "Allow" Principal: Service: "cloudtrail.amazonaws.com" Action: "s3:GetBucketAcl" Resource: !Sub |- arn:aws:s3:::${S3Bucket} Sid: "AWSCloudTrailWrite" Effect: "Allow" Principal: Service: "cloudtrail.amazonaws.com" Action: "s3:PutObject" Resource: !Sub |- arn:aws:s3:::${S3Bucket}/AWSLogs/${AWS::AccountId}/* Condition: StringEquals: s3:x-amz-acl: "bucket-owner-full-control" Topic: Type: AWS::SNS::Topic Properties: Subscription: Endpoint: Ref: OperatorEmail Protocol: email TopicPolicy: Type: AWS::SNS::TopicPolicy Properties: Topics: Ref: "Topic" PolicyDocument: Version: "2008-10-17" Statement: Sid: "AWSCloudTrailSNSPolicy" Effect: "Allow" Principal: Service: "cloudtrail.amazonaws.com" Resource: "*" Action: "SNS:Publish" myTrail: DependsOn: BucketPolicy TopicPolicy Type: AWS::CloudTrail::Trail Properties: S3BucketName: Ref: S3Bucket SnsTopicName: Fn::GetAtt: Topic TopicName IsLogging: true IsMultiRegionTrail: false myTrail2: DependsOn: BucketPolicy TopicPolicy Type: AWS::CloudTrail::Trail Properties: S3BucketName: Ref: S3Bucket SnsTopicName: Fn::GetAtt: Topic TopicName IsLogging: true ``` ```json title="Positive test num. 2 - json file" hl_lines="32 17" { "AWSTemplateFormatVersion": "2010-09-09", "Parameters": { "OperatorEmail": { "Description": "Email address to notify when new logs are published.", "Type": "String" } }, "Resources": { "myTrail": { "DependsOn": [ "BucketPolicy", "TopicPolicy" ], "Type": "AWS::CloudTrail::Trail", "Properties": { "IsMultiRegionTrail": false, "S3BucketName": { "Ref": "S3Bucket" }, "SnsTopicName": { "Fn::GetAtt": [ "Topic", "TopicName" ] }, "IsLogging": true } }, "myTrail2": { "Type": "AWS::CloudTrail::Trail", "Properties": { "S3BucketName": { "Ref": "S3Bucket" }, "SnsTopicName": { "Fn::GetAtt": [ "Topic", "TopicName" ] }, "IsLogging": true }, "DependsOn": [ "BucketPolicy", "TopicPolicy" ] }, "S3Bucket": { "Properties": {}, "DeletionPolicy": "Retain", "Type": "AWS::S3::Bucket" }, "BucketPolicy": { "Type": "AWS::S3::BucketPolicy", "Properties": { "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Resource": "arn:aws:s3:::${S3Bucket}", "Sid": "AWSCloudTrailAclCheck", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Action": "s3:GetBucketAcl" }, { "Sid": "AWSCloudTrailWrite", "Effect": "Allow", "Principal": { "Service":

}, "Action": "s3:PutObject", "Resource": "arn:aws:s3:::${S3Bucket}/AWSLogs/${AWS::AccountId}/*", "Condition": { "StringEquals": { "s3:x-amz-acl": "bucket-owner-full-control" } } } ] }, "Bucket": { "Ref": "S3Bucket" } } }, "Topic": { "Type": "AWS::SNS::Topic", "Properties": { "Subscription": [ { "Endpoint": { "Ref": "OperatorEmail" }, "Protocol": "email" } ] } }, "TopicPolicy": { "Type": "AWS::SNS::TopicPolicy", "Properties": { "PolicyDocument": { "Version": "2008-10-17", "Statement": [ { "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Resource": "*", "Action": "SNS:Publish", "Sid": "AWSCloudTrailSNSPolicy", "Effect": "Allow" } ] }, "Topics": [ { "Ref": "Topic" } ] } } } } ``` ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: "2010-09-09" Parameters: OperatorEmail: Description: "Email address to notify when new logs are published." Type: String Resources: S3Bucket: DeletionPolicy: Retain Type: AWS::S3::Bucket Properties: {} BucketPolicy: Type: AWS::S3::BucketPolicy Properties: Bucket: Ref: S3Bucket PolicyDocument: Version: "2012-10-17" Statement: Sid: "AWSCloudTrailAclCheck" Effect: "Allow" Principal: Service: "cloudtrail.amazonaws.com" Action: "s3:GetBucketAcl" Resource: !Sub |- arn:aws:s3:::${S3Bucket} Sid: "AWSCloudTrailWrite" Effect: "Allow" Principal: Service: "cloudtrail.amazonaws.com" Action: "s3:PutObject" Resource: !Sub |- arn:aws:s3:::${S3Bucket}/AWSLogs/${AWS::AccountId}/* Condition: StringEquals: s3:x-amz-acl: "bucket-owner-full-control" Topic: Type: AWS::SNS::Topic Properties: Subscription: Endpoint: Ref: OperatorEmail Protocol: email TopicPolicy: Type: AWS::SNS::TopicPolicy Properties: Topics: Ref: "Topic" PolicyDocument: Version: "2008-10-17" Statement: Sid: "AWSCloudTrailSNSPolicy" Effect: "Allow" Principal: Service: "cloudtrail.amazonaws.com" Resource: "*" Action: "SNS:Publish" myTrail: DependsOn: BucketPolicy TopicPolicy Type: AWS::CloudTrail::Trail Properties: S3BucketName: Ref: S3Bucket SnsTopicName: Fn::GetAtt: Topic TopicName IsLogging: true IsMultiRegionTrail: true ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09", "Parameters": { "OperatorEmail": { "Description": "Email address to notify when new logs are published.", "Type": "String" } }, "Resources": { "TopicPolicy": { "Type": "AWS::SNS::TopicPolicy", "Properties": { "Topics": [ { "Ref": "Topic" } ], "PolicyDocument": { "Version": "2008-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Resource": "*", "Action": "SNS:Publish", "Sid": "AWSCloudTrailSNSPolicy" } ] } } }, "myTrail": { "Type": "AWS::CloudTrail::Trail", "Properties": { "S3BucketName": { "Ref": "S3Bucket" }, "SnsTopicName": { "Fn::GetAtt": [ "Topic", "TopicName" ] }, "IsLogging": true, "IsMultiRegionTrail": true }, "DependsOn": [ "BucketPolicy", "TopicPolicy" ] }, "S3Bucket": { "Properties": {}, "DeletionPolicy": "Retain", "Type": "AWS::S3::Bucket" }, "BucketPolicy": { "Properties": { "Bucket": { "Ref": "S3Bucket" }, "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Action": "s3:GetBucketAcl", "Resource": "arn:aws:s3:::${S3Bucket}", "Sid": "AWSCloudTrailAclCheck", "Effect": "Allow" }, { "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Action": "s3:PutObject", "Resource": "arn:aws:s3:::${S3Bucket}/AWSLogs/${AWS::AccountId}/*", "Condition": { "StringEquals": { "s3:x-amz-acl": "bucket-owner-full-control" } }, "Sid": "AWSCloudTrailWrite" } ] } }, "Type": "AWS::S3::BucketPolicy" }, "Topic": { "Type": "AWS::SNS::Topic", "Properties": { "Subscription": [ { "Endpoint": { "Ref": "OperatorEmail" }, "Protocol": "email" } ] } } } } ```