CloudTrail trail should have log file validation enabled

What it checks

CloudTrail trail: log file validation is not enabled.

Where it applies

Terraform: aws_cloudtrail

CloudFormation: AWS::CloudTrail::Trail

How to fix it

1. Set enable_log_file_validation = true. AWS generates SHA-256 digest files every hour to verify log integrity.

Frameworks

• AWS FSBP CloudTrail.4
• SOC 2 CC7.2
• PCI-DSS v4.0.1/10.3.2
• HIPAA 164.312(c)(1)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules