Check ID: cloudtrail_multi_region_enabled_logging_management_events
Provider: AWS
Service: cloudtrail
Severity: LOW
Categories: logging, forensics-ready
Resource type: AwsCloudTrailTrail

​
What this check verifies

CloudTrail trails record management events (read and write) in every AWS region and are actively logging, using a multi-region trail or per-region coverage.

​
Risk

Without region-wide management event logging, changes to identities, networking, and audit settings can go untracked. Adversaries can operate in overlooked regions to create resources, modify permissions, or disable logging, undermining integrity, confidentiality, and incident response.

​
Recommendation

Enable a multi-region CloudTrail that logs management events for read and write in all regions. Centralize logs in a separate, locked-down account; apply least privilege, encryption, retention, and integrity validation; and protect trails and storage with tamper-evident, deny-delete controls for defense-in-depth.

​
Remediation

# Terraform: enable multi-region and log management events (read & write)
resource "aws_cloudtrail" "<example_resource_name>" {
  name           = "<example_resource_name>"
  s3_bucket_name = "<example_resource_name>"

  is_multi_region_trail = true  # CRITICAL: apply the trail to all regions

  event_selector {
    include_management_events = true  # CRITICAL: log management events
    read_write_type           = "All" # CRITICAL: log both read & write
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudtrail_multi_region_enabled_logging_management_events. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks