CloudTrail trail has log file validation enabled

Check ID: cloudtrail_log_file_validation_enabled
Provider: AWS
Service: cloudtrail
Severity: MEDIUM
Categories: logging, forensics-ready
Resource type: AwsCloudTrailTrail

What this check verifies

AWS CloudTrail trails are evaluated for log file integrity validation being enabled (LogFileValidationEnabled). When enabled, CloudTrail generates signed digest files to verify that S3-delivered log files remain unchanged.

Risk

Without validation, adversaries can alter, forge, or delete audit entries without detection, compromising log integrity and non-repudiation. This impairs investigations, enables alert evasion, and obscures unauthorized changes across regions or accounts.

Recommendation

Enable log file integrity validation on all trails (LogFileValidationEnabled=true). Enforce least privilege on the logs bucket, retain and protect digest files (e.g., S3 Object Lock/MFA Delete), and monitor validation results to support defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws cloudtrail update-trail —name <trail_name> —enable-log-file-validation

# Enable log file validation on a CloudTrail trail
resource "aws_cloudtrail" "<example_resource_name>" {
  name               = "<example_resource_name>"
  s3_bucket_name     = "<example_resource_name>"
  enable_log_file_validation = true  # Critical: ensures CloudTrail writes signed digests to detect tampering
}

# CloudFormation: Enable log file validation on a CloudTrail trail
Resources:
  <example_resource_name>:
    Type: AWS::CloudTrail::Trail
    Properties:
      S3BucketName: <example_resource_name>
      EnableLogFileValidation: true  # Critical: enables integrity validation for delivered log files

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudtrail_log_file_validation_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

CloudTrail trail logs are encrypted at rest with a KMS key CloudTrail destination S3 bucket has access logging

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires