AWS CloudTrail
Best practices and references below are based on published guidance from the cloud service provider and may reference native capabilities the cloud service provider offers. If you are not using the native security capabilities, the same security requirement can be met using other security capabilities your organization utilizes
AWS Detective Security Best Practices
AWS Preventative Security Best Practices
Consider the the following best practices for CloudTrail.
Create a trail
For an ongoing record of events in your AWS account, you must create a trail. Although CloudTrail provides 90 days of event history information for management events in the CloudTrail console without creating a trail, it is not a permanent record, and it does not provide information about all possible types of events. For an ongoing record, and for a record that contains all the event types you specify, you must create a trail, which delivers log files to an Amazon S3 bucket that you specify.
To help manage your CloudTrail data, consider creating one trail that logs management events in all AWS Regions, and then creating additional trails that log specific event types for resources, such as Amazon S3 bucket activity or AWS Lambda functions.
Apply trails to all AWS Regions
To obtain a complete record of events taken by a user, role, or service in your AWS account, each trail should be configured to log events in all AWS Regions. By logging events in all AWS Regions, you ensure that all events that occur in your AWS account are logged, regardless of which AWS Region where they occurred. This includes logging global service events, which are logged to an AWS Region specific to that service. When you create a trail that applies to all regions, CloudTrail records events in each region and delivers the CloudTrail event log files to an S3 bucket that you specify. If an AWS Region is added after you create a trail that applies to all regions, that new region is automatically included, and events in that region are logged. This is the default option when you create a trail in the CloudTrail console
Enable CloudTrail log file integrity
Validated log files are especially valuable in security and forensic investigations. For example, a validated log file enables you to assert positively that the log file itself has not changed, or that particular user credentials performed specific API activity. The CloudTrail log file integrity validation process also lets you know if a log file has been deleted or changed, or assert positively that no log files were delivered to your account during a given period of time. CloudTrail log file integrity validation uses industry standard algorithms: SHA-256 for hashing and SHA-256 with RSA for digital signing. This makes it computationally unfeasible to modify, delete or forge CloudTrail log files without detection
Integrate with Amazon CloudWatch Logs
CloudWatch Logs allows you to monitor and receive alerts for specific events captured by CloudTrail. The events sent to CloudWatch Logs are those configured to be logged by your trail, so make sure you have configured your trail or trails to log the event types (management events and/or data events) that you are interested in monitoring
The following best practices for CloudTrail can help prevent security incidents
Log to a dedicated and centralized Amazon S3 bucket
CloudTrail log files are an audit log of actions taken by a user, role or an AWS service. The integrity, completeness and availability of these logs is crucial for forensic and auditing purposes. By logging to a dedicated and centralized Amazon S3 bucket, you can enforce strict security controls, access, and segregation of duties.
The following are some steps you can take:
- Create a separate AWS account as a log archive account. If you use AWS Organizations, enroll this account in the organization, and consider creating an organization trail to log data for all AWS accounts in your organization.
- If you do not use Organizations but want to log data for multiple AWS accounts, create a trail to log activity in this log archive account. Restrict access to this account to only trusted administrative users who should have access to account and auditing data.
- As part of creating a trail, whether it is an organization trail or a trail for a single AWS account, create a dedicated Amazon S3 bucket to store log files for this trail.
- If you want to log activity for more than one AWS account, modify the bucket policy to allow logging and storing log files for all AWS accounts that you want to log AWS account activity.
- If you are not using an organization trail, create trails in all of your AWS accounts, specifying the Amazon S3 bucket in the log archive account.
Use server-side encryption with AWS KMS managed keys
By default, the log files delivered by CloudTrail to your bucket are encrypted by Amazon server-side encryption with Amazon S3-managed encryption keys (SSE-S3). To provide a security layer that is directly manageable, you can instead use server-side encryption with AWS KMS–managed keys (SSE-KMS) for your CloudTrail log files. To use SSE-KMS with CloudTrail, you create and manage an AWS KMS key, also known as a KMS key.
If you use SSE-KMS and log file validation, and you have modified your Amazon S3 bucket policy to only allow SSE-KMS encrypted files, you will not be able to create trails that utilize that bucket unless you modify your bucket policy to specifically allow AES256 encryption
Add a condition key to the default Amazon SNS topic policy
When you configure a trail to send notifications to Amazon SNS, CloudTrail adds a policy statement to your SNS topic access policy that allows CloudTrail to send content to an SNS topic. As a security best practice, we recommend adding an
aws:SourceArn (or optionally aws:SourceAccount) condition key to the CloudTrail policy statement. This helps prevent unauthorized account access to your SNS topicImplement least privilege access to Amazon S3 buckets where you store log files
CloudTrail trails log events to an Amazon S3 bucket that you specify. These log files contain an audit log of actions taken by users, roles, and AWS services. The integrity and completeness of these log files are crucial for auditing and forensic purposes. In order to help ensure that integrity, you should adhere to the principle of least privilege when creating or modifying access to any Amazon S3 bucket used for storing CloudTrail log files.
Take the following steps:
- Review the Amazon S3 bucket policy for any and all buckets where you store log files and adjust it if necessary to remove any unnecessary access. This bucket policy will be generated for you if you create a trail using the CloudTrail console, but can also be created and managed manually.
- As a security best practice, be sure to manually add a
aws:SourceArncondition key to the bucket policy - If you are using the same Amazon S3 bucket to store log files for multiple AWS accounts, follow the guidance for receiving log files for multiple accounts.
- If you are using an organization trail, make sure you follow the guidance for organization trails, and review the example policy for an Amazon S3 bucket for an organization trail in Creating a trail for an organization with the AWS Command Line Interface.
Enable MFA Delete on the Amazon S3 bucket where you store log files
Configuring multi-factor authentication (MFA) ensures that any attempt to change the versioning state of your bucket or permanently delete an object version requires additional authentication. This helps prevent any operation that could compromise the integrity of your log files, even if a user acquires the password of an IAM user that has permissions to permanently delete Amazon S3 objects.
Configure object lifecycle management on the Amazon S3 bucket where you store log files
The CloudTrail trail default is to store log files indefinitely in the Amazon S3 bucket configured for the trail. You can use the Amazon S3 object lifecycle management rules to define your own retention policy to better meet your business and auditing needs. For example, you might want to archive log files that are more than a year old to Amazon Glacier, or delete log files after a certain amount of time has passed.
Limit access to the AWSCloudTrail_FullAccess policy
Users with the AWSCloudTrail_FullAccess policy have the ability to disable or reconfigure the most sensitive and important auditing functions in their AWS accounts. This policy is not intended to be shared or applied broadly to users and roles in your AWS account. Limit application of this policy to as few individuals as possible, those you expect to act as AWS account administrators
Design Guidance:
Cloud Watch Logs Log Group Arn | ||
Cloud Watch Logs Role Arn | ||
Data Resources-Type | ||
Data Resources-Values | ||
Event Selectors-Include Management Events | ||
Event Selectors-Read Write Type | ||
Include Global Service Events | ||
Is Logging | ||
S3bucket Name | ||
S3key Prefix |
Design Guidance:
Enable Log File Validation | ||
Kmskey Id |
Design Guidance:
Is Multi Region Trail |
Design Guidance:
Tags | ||
Trail Name |
Last modified 6mo ago