CloudTrail Not Integrated With CloudWatch

  • Query id: ebb2118a-03bc-4d53-ab43-d8750f5cb8d3
  • Query name: CloudTrail Not Integrated With CloudWatch
  • Platform: Ansible
  • Severity: Medium
  • Category: Observability
  • URL: Github

Description

CloudTrail should be integrated with CloudWatch
Documentation

Code samples

Code samples with security vulnerabilities

Postitive test num. 1 - yaml file
- name: positive1
  community.aws.cloudtrail:
    state: present
    name: default
    s3_bucket_name: mylogbucket
    region: us-east-1
    is_multi_region_trail: true
    enable_log_file_validation: true
    kms_key_id: "alias/MyAliasName"
    tags:
      environment: dev
      Name: default
- name: positive2
  community.aws.cloudtrail:
    state: present
    name: default
    s3_bucket_name: mylogbucket
    region: us-east-1
    is_multi_region_trail: true
    enable_log_file_validation: true
    cloudwatch_logs_role_arn: "arn:aws:iam::123456789012:role/CloudTrail_CloudWatchLogs_Role"
    kms_key_id: "alias/MyAliasName"
    tags:
      environment: dev
      Name: default
- name: positive3
  community.aws.cloudtrail:
    state: present
    name: default
    s3_bucket_name: mylogbucket
    region: us-east-1
    is_multi_region_trail: true
    enable_log_file_validation: true
    cloudwatch_logs_log_group_arn: "arn:aws:logs:us-east-1:123456789012:log-group:CloudTrail/DefaultLogGroup:*"
    kms_key_id: "alias/MyAliasName"
    tags:
      environment: dev
      Name: default

Code samples without security vulnerabilities

Negative test num. 1 - yaml file
- name: create multi-region trail with validation and tags negative
  community.aws.cloudtrail:
    state: present
    name: default
    s3_bucket_name: mylogbucket
    region: us-east-1
    is_multi_region_trail: true
    enable_log_file_validation: true
    cloudwatch_logs_role_arn: "arn:aws:iam::123456789012:role/CloudTrail_CloudWatchLogs_Role"
    cloudwatch_logs_log_group_arn: "arn:aws:logs:us-east-1:123456789012:log-group:CloudTrail/DefaultLogGroup:*"
    kms_key_id: "alias/MyAliasName"
    tags:
      environment: dev
      Name: default