AnalysisType: policy
Filename: aws_cloudtrail_log_validation.py
PolicyID: "AWS.CloudTrail.LogValidation"
DisplayName: "AWS CloudTrail Log Validation"
Enabled: true
ResourceTypes:
- AWS.CloudTrail
Tags:
- AWS
- Data Protection
- Defense Evasion:Impair Defenses
Reports:
CIS:
- 2.2
PCI:
- 10.5.5
MITRE ATT&CK:
- TA0005:T1562
Severity: Medium
Description: >
This policy ensures that CloudTrail logs have file integrity validation enabled.
Runbook: >
https://docs.runpanther.io/alert-runbooks/built-in-policies/aws-cloudtrail-log-validation-enabled
Reference: >
https://amzn.to/2MMgE6W
Tests:
- Name: Log File Validation Disabled
ExpectedResult: false
Resource:
{
"EventSelectors":
[
{
"DataResources": [{ "Type": "AWS::S3::Object", "Values": null }],
"IncludeManagementEvents": false,
"ReadWriteType": "All",
},
],
"CloudWatchLogsLogGroupArn": null,
"CloudWatchLogsRoleArn": null,
"HasCustomEventSelectors": true,
"HomeRegion": "us-west-2",
"IncludeGlobalServiceEvents": true,
"IsMultiRegionTrail": false,
"IsOrganizationTrail": false,
"KmsKeyId": null,
"LogFileValidationEnabled": false,
"Name": "cloudtrail-name",
"S3BucketName": "bucket-name",
"S3KeyPrefix": null,
"SnsTopicARN": null,
"SnsTopicName": null,
"TrailARN": "arn:aws:cloudtrail:us-west-2:112233445566:trail/cloudtrail-name",
"Status":
{
"IsLogging": true,
"LatestCloudWatchLogsDeliveryError": null,
"LatestCloudWatchLogsDeliveryTime": null,
"LatestDeliveryAttemptSucceeded": "2019-01-01T00:00:00Z",
"LatestDeliveryAttemptTime": "2019-01-01T00:00:00Z",
"LatestDeliveryError": null,
"LatestDeliveryTime": "2019-01-01T00:00:00Z",
"LatestDigestDeliveryError": null,
"LatestDigestDeliveryTime": "2019-01-01T00:00:00Z",
"LatestNotificationAttemptSucceeded": null,
"LatestNotificationAttemptTime": null,
"LatestNotificationError": null,
"LatestNotificationTime": null,
"StartLoggingTime": "2019-01-01T00:00:00Z",
"StopLoggingTime": null,
"TimeLoggingStarted": "2019-01-01T00:00:00Z",
"TimeLoggingStopped": null,
},
}
- Name: Log File Validation Enabled
ExpectedResult: true
Resource:
{
"EventSelectors":
[
{
"DataResources": [{ "Type": "AWS::S3::Object", "Values": null }],
"IncludeManagementEvents": false,
"ReadWriteType": "All",
},
],
"CloudWatchLogsLogGroupArn": null,
"CloudWatchLogsRoleArn": null,
"HasCustomEventSelectors": true,
"HomeRegion": "us-west-2",
"IncludeGlobalServiceEvents": true,
"IsMultiRegionTrail": false,
"IsOrganizationTrail": false,
"KmsKeyId": null,
"LogFileValidationEnabled": true,
"Name": "cloudtrail-name",
"S3BucketName": "bucket-name",
"S3KeyPrefix": null,
"SnsTopicARN": null,
"SnsTopicName": null,
"TrailARN": "arn:aws:cloudtrail:us-west-2:112233445566:trail/cloudtrail-name",
"Status":
{
"IsLogging": true,
"LatestCloudWatchLogsDeliveryError": null,
"LatestCloudWatchLogsDeliveryTime": null,
"LatestDeliveryAttemptSucceeded": "2019-01-01T00:00:00Z",
"LatestDeliveryAttemptTime": "2019-01-01T00:00:00Z",
"LatestDeliveryError": null,
"LatestDeliveryTime": "2019-01-01T00:00:00Z",
"LatestDigestDeliveryError": null,
"LatestDigestDeliveryTime": "2019-01-01T00:00:00Z",
"LatestNotificationAttemptSucceeded": null,
"LatestNotificationAttemptTime": null,
"LatestNotificationError": null,
"LatestNotificationTime": null,
"StartLoggingTime": "2019-01-01T00:00:00Z",
"StopLoggingTime": null,
"TimeLoggingStarted": "2019-01-01T00:00:00Z",
"TimeLoggingStopped": null,
},
}
- Name: Log File Validation Not Set
ExpectedResult: false
Resource:
{
"EventSelectors":
[
{
"DataResources": [{ "Type": "AWS::S3::Object", "Values": null }],
"IncludeManagementEvents": false,
"ReadWriteType": "All",
},
],
"CloudWatchLogsLogGroupArn": null,
"CloudWatchLogsRoleArn": null,
"HasCustomEventSelectors": true,
"HomeRegion": "us-west-2",
"IncludeGlobalServiceEvents": true,
"IsMultiRegionTrail": false,
"IsOrganizationTrail": false,
"KmsKeyId": null,
"LogFileValidationEnabled": null,
"Name": "cloudtrail-name",
"S3BucketName": "bucket-name",
"S3KeyPrefix": null,
"SnsTopicARN": null,
"SnsTopicName": null,
"TrailARN": "arn:aws:cloudtrail:us-west-2:112233445566:trail/cloudtrail-name",
"Status":
{
"IsLogging": true,
"LatestCloudWatchLogsDeliveryError": null,
"LatestCloudWatchLogsDeliveryTime": null,
"LatestDeliveryAttemptSucceeded": "2019-01-01T00:00:00Z",
"LatestDeliveryAttemptTime": "2019-01-01T00:00:00Z",
"LatestDeliveryError": null,
"LatestDeliveryTime": "2019-01-01T00:00:00Z",
"LatestDigestDeliveryError": null,
"LatestDigestDeliveryTime": "2019-01-01T00:00:00Z",
"LatestNotificationAttemptSucceeded": null,
"LatestNotificationAttemptTime": null,
"LatestNotificationError": null,
"LatestNotificationTime": null,
"StartLoggingTime": "2019-01-01T00:00:00Z",
"StopLoggingTime": null,
"TimeLoggingStarted": "2019-01-01T00:00:00Z",
"TimeLoggingStopped": null,
},
}
# ------ paired body: aws_cloudtrail_log_validation.py ------
def policy(resource):
# Explicit check for True as the value may be None, and we want to return a bool not a NoneType
return resource["LogFileValidationEnabled"] is True