Skip to content

Enable CloudTrail log file validation #220

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ale210 merged 1 commit into from
Oct 29, 2026
Merged

Enable CloudTrail log file validation #220

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 6 additions & 7 deletions terraform/cloudtrail.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,12 +10,11 @@
// events. Neither is an organization trail, so neither covers the payer account
// 504695638931.
//
// This file adopts what is there as-is. Four things are missing from both trails and are
// This file adopts what is there as-is. Three things are missing from both trails and are
// deliberately NOT added here, because each changes live behaviour and belongs in its own
// ticket: KMS encryption (both use SSE-S3), a CloudWatch Logs destination (so there is no
// alerting path off either trail), a bucket lifecycle configuration (logs accumulate
// indefinitely), and the disagreement over log file validation, which is reproduced below
// rather than resolved.
// alerting path off either trail), and a bucket lifecycle configuration (logs accumulate
// indefinitely).
//
// Everything here is skipped unless var.iam_only is false (see variables.tf). The bucket
// names, bucket policies and the backend bucket selector all belong to the Hack for LA
Expand Down Expand Up @@ -239,16 +238,16 @@ resource "aws_s3_bucket_server_side_encryption_configuration" "management_events
}
}

// Log file validation is off on this trail and on for the other. That inconsistency is
// reproduced rather than resolved -- turning it on is a live change and its own ticket.
// Log file validation is enabled on both trails, so the two trails now agree.
// Validation is on for both.
resource "aws_cloudtrail" "management_events" {
count = var.iam_only ? 0 : 1

name = "management-events"
s3_bucket_name = aws_s3_bucket.management_events[0].id
include_global_service_events = true
is_multi_region_trail = true
enable_log_file_validation = false
enable_log_file_validation = true

advanced_event_selector {
name = "Management events selector"
Expand Down
Loading