CloudTrail trail has Insights enabled

Check ID: cloudtrail_insights_exist
Provider: AWS
Service: cloudtrail
Severity: LOW
Categories: forensics-ready
Resource type: AwsCloudTrailTrail

What this check verifies

CloudTrail trails that are logging are evaluated for Insights via insight selectors, which enable anomaly detection on management-event patterns (API call and error rates). The finding pinpoints logging trails where these selectors are missing.

Risk

Without Insights, abnormal API call or error rates can go unnoticed, delaying detection of credential abuse, privilege escalation, or runaway automation. Attackers may rapidly alter policies, delete resources, or exfiltrate data before response, impacting confidentiality and availability.

Recommendation

Enable CloudTrail Insights on all logging trails (ideally all-Region or organization trails). Activate both ApiCallRateInsight and ApiErrorRateInsight. Integrate alerts with monitoring and review anomalies regularly. Apply defense in depth and least privilege to reduce potential blast radius.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws cloudtrail put-insight-selectors --trail-name <TRAIL_NAME> --insight-selectors '[{"InsightType":"ApiCallRateInsight"}]'

resource "aws_cloudtrail" "<example_resource_name>" {
  name           = "<example_resource_name>"
  s3_bucket_name = "<example_resource_name>"
  enable_logging = true

  insight_selector {
    insight_type = "ApiCallRateInsight"  # Critical fix: enables CloudTrail Insights on the trail
  }
}

Resources:
  <example_resource_name>:
    Type: AWS::CloudTrail::Trail
    Properties:
      TrailName: <example_resource_name>
      S3BucketName: <example_resource_name>
      IsLogging: true
      InsightSelectors:
        - InsightType: ApiCallRateInsight  # Critical fix: enables CloudTrail Insights on the trail

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudtrail_insights_exist. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

CloudTrail delivered logs to CloudWatch in last 24 hours CloudTrail trail logs are encrypted at rest with a KMS key

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires