Check ID: cloudtrail_multi_region_enabled
Provider: AWS
Service: cloudtrail
Severity: HIGH
Categories: logging, forensics-ready
Resource type: AwsCloudTrailTrail

​
What this check verifies

AWS CloudTrail has at least one trail with logging enabled in every region. A multi-region trail or a regional trail counts for coverage in that region.

​
Risk

Missing coverage in any region creates visibility gaps. Attackers can use lesser-monitored regions to run API actions, hide unauthorized changes, and exfiltrate data without audit trails, weakening detective controls, hindering forensics, and delaying response (confidentiality and integrity).

​
Recommendation

Use a multi-region CloudTrail trail or per-region trails so logging is active in every region, including unused ones. Centralize logs, enforce least privilege to log stores, and add defense-in-depth with encryption, integrity validation, and retention. Continuously monitor trail health to catch gaps.

​
Remediation

# Terraform: Multi-region CloudTrail with logging enabled
resource "aws_cloudtrail" "<example_resource_name>" {
  name           = "<example_resource_name>"
  s3_bucket_name = "<example_resource_name>"

  is_multi_region_trail = true  # Critical: applies the trail to all regions
  enable_logging        = true  # Critical: ensures the trail is logging
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudtrail_multi_region_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks