Policy: AWS > CIS v1 > 2 Logging > 2.02 Ensure CloudTrail log file validation is enabled (Scored)
Configures auditing against a CIS Benchmark item.
Level: 2 (Scored)
CloudTrail log file validation creates a digitally signed digest file containing a hash of each log that CloudTrail writes to S3. These digest files can be used to determine whether a log file was changed, deleted, or unchanged after CloudTrail delivered the log. It is recommended that file validation be enabled on all CloudTrails.
Resource Types
This policy targets the following resource types:
Primary Policy
This policy is used with the following primary policy:
Controls
- AWS > CIS v1
- AWS > CIS v1 > 2 Logging > 2.02 Ensure CloudTrail log file validation is enabled (Scored)
- AWS > CIS v1 > 2 Logging
Policy Specification
Schema Type |
|
---|---|
Default |
|
Valid Values [YAML] |
|
Category
In Your Workspace
Developers
- tmod:@turbot/cis#/control/categories/v0706
- tmod:@turbot/aws-cisv1#/policy/types/r0202
- turbot graphql policy-type --id "tmod:@turbot/aws-cisv1#/policy/types/r0202"
- turbot graphql policy-settings --filter "policyTypeId:tmod:@turbot/aws-cisv1#/policy/types/r0202"
Get Policy TypeGet Policy Settings
Category URI
Policy Type URI
GraphQL
CLI