Check ID: cloudtrail_bucket_requires_mfa_delete
Provider: AWS
Service: cloudtrail
Severity: MEDIUM
Categories: identity-access, forensics-ready
Resource type: AwsCloudTrailTrail

​
What this check verifies

CloudTrail log buckets for actively logging trails are evaluated for MFA Delete on the associated S3 bucket. The assessment determines whether MFA Delete is configured on the in-account log bucket; if the bucket resides in another account, its configuration should be verified separately.

​
Risk

Without MFA Delete, stolen or over-privileged credentials can permanently delete log versions or change versioning, compromising log integrity and availability. This enables attacker cover-ups, hinders forensics, and weakens evidence for investigations.

​
Recommendation

Enable MFA Delete on the CloudTrail log bucket with versioning enabled. Enforce least privilege so only tightly controlled identities can delete or alter logs, and require MFA for such actions. Apply defense in depth using a dedicated logging account and log file integrity validation.

​
Remediation

aws s3api put-bucket-versioning --bucket <CLOUDTRAIL_BUCKET_NAME> --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa "<MFA_SERIAL> <MFA_CODE>"

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudtrail_bucket_requires_mfa_delete. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks