CloudTrail Not Integrated With CloudWatch

• Query id: ebb2118a-03bc-4d53-ab43-d8750f5cb8d3
• Query name: CloudTrail Not Integrated With CloudWatch
• Platform: Ansible
• Severity: Low
• Category: Observability
• CWE: 778
• URL: Github

Description

CloudTrail should be integrated with CloudWatch
Documentation

Code samples

Code samples with security vulnerabilities

Positive test num. 1 - yaml file

- name: positive1
  community.aws.cloudtrail:
    state: present
    name: default
    s3_bucket_name: mylogbucket
    region: us-east-1
    is_multi_region_trail: true
    enable_log_file_validation: true
    kms_key_id: "alias/MyAliasName"
    tags:
      environment: dev
      Name: default
- name: positive2
  community.aws.cloudtrail:
    state: present
    name: default
    s3_bucket_name: mylogbucket
    region: us-east-1
    is_multi_region_trail: true
    enable_log_file_validation: true
    cloudwatch_logs_role_arn: "arn:aws:iam::123456789012:role/CloudTrail_CloudWatchLogs_Role"
    kms_key_id: "alias/MyAliasName"
    tags:
      environment: dev
      Name: default
- name: positive3
  community.aws.cloudtrail:
    state: present
    name: default
    s3_bucket_name: mylogbucket
    region: us-east-1
    is_multi_region_trail: true
    enable_log_file_validation: true
    cloudwatch_logs_log_group_arn: "arn:aws:logs:us-east-1:123456789012:log-group:CloudTrail/DefaultLogGroup:*"
    kms_key_id: "alias/MyAliasName"
    tags:
      environment: dev
      Name: default

Code samples without security vulnerabilities

Negative test num. 1 - yaml file

- name: create multi-region trail with validation and tags negative
  community.aws.cloudtrail:
    state: present
    name: default
    s3_bucket_name: mylogbucket
    region: us-east-1
    is_multi_region_trail: true
    enable_log_file_validation: true
    cloudwatch_logs_role_arn: "arn:aws:iam::123456789012:role/CloudTrail_CloudWatchLogs_Role"
    cloudwatch_logs_log_group_arn: "arn:aws:logs:us-east-1:123456789012:log-group:CloudTrail/DefaultLogGroup:*"
    kms_key_id: "alias/MyAliasName"
    tags:
      environment: dev
      Name: default