CloudTrail trail should have logging enabled

What it checks

CloudTrail trail should have logging enabled

Where it applies

Terraform: aws_cloudtrail

CloudFormation: AWS::CloudTrail::Trail

How to fix it

1. Set enable_logging = true (or remove it — it defaults to true). Consider an AWS Organizations SCP denying cloudtrail:StopLogging and cloudtrail:DeleteTrail to prevent future disables.

Frameworks

• NIST 800-53 rev5 AU-2
• SOC 2 CC7.2

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules