CloudTrail trail should integrate with CloudWatch Logs

What it checks

CloudTrail trail should integrate with CloudWatch Logs

Where it applies

Terraform: aws_cloudtrail

CloudFormation: AWS::CloudTrail::Trail

How to fix it

1. Create a CloudWatch log group and IAM role for CloudTrail delivery, then set cloud_watch_logs_group_arn and cloud_watch_logs_role_arn.
2. After integration, add metric filters for the events worth alarming on: root login, unauthorized API calls, security group changes

Frameworks

• AWS FSBP CloudTrail.5
• SOC 2 CC7.2
• HIPAA 164.312(b)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules