Back to Checks
aws

CloudTrail trail has Insights enabled

cloudtrail_insights_exist
Service: cloudtrailSeverity: low
OfficialBuilt-inVerified
Categories:forensics-ready
Resource Type:AwsCloudTrailTrail

CloudTrail trails that are logging are evaluated for Insights via insight selectors, which enable anomaly detection on management-event patterns (API call and error rates). The finding pinpoints logging trails where these selectors are missing.

Prowler logoProwlerprowler-provider-aws

Risk

Without Insights, abnormal API call or error rates can go unnoticed, delaying detection of credential abuse, privilege escalation, or runaway automation. Attackers may rapidly alter policies, delete resources, or exfiltrate data before response, impacting confidentiality and availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks cloudtrail_insights_exist

Recommendation

Enable CloudTrail Insights on all logging trails (ideally all-Region or organization trails). Activate both ApiCallRateInsight and ApiErrorRateInsight. Integrate alerts with monitoring and review anomalies regularly. Apply defense in depth and least privilege to reduce potential blast radius.

Remediation

CLI

aws cloudtrail put-insight-selectors --trail-name <TRAIL_NAME> --insight-selectors '[{"InsightType":"ApiCallRateInsight"}]'

Terraform

resource "aws_cloudtrail" "<example_resource_name>" {
  name           = "<example_resource_name>"
  s3_bucket_name = "<example_resource_name>"
  enable_logging = true

  insight_selector {
    insight_type = "ApiCallRateInsight"  # Critical fix: enables CloudTrail Insights on the trail
  }
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::CloudTrail::Trail
    Properties:
      TrailName: <example_resource_name>
      S3BucketName: <example_resource_name>
      IsLogging: true
      InsightSelectors:
        - InsightType: ApiCallRateInsight  # Critical fix: enables CloudTrail Insights on the trail

Other

1In the AWS Console, go to CloudTrail > Trails
2Select the trail that is logging
3Click Edit on the CloudTrail Insights section
4Enable Insights and select API call rate (or Error rate)
5Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.cloudtrail.cloudtrail_client import (
    cloudtrail_client,
)


class cloudtrail_insights_exist(Check):
    def execute(self):
        findings = []
        if cloudtrail_client.trails is not None:
            for trail in cloudtrail_client.trails.values():
                if trail.is_logging:
                    report = Check_Report_AWS(metadata=self.metadata(), resource=trail)
                    report.region = trail.home_region
                    report.status = "FAIL"
                    report.status_extended = f"Trail {trail.name} does not have insight selectors and it is logging."
                    if trail.has_insight_selectors:
                        report.status = "PASS"
                        report.status_extended = f"Trail {trail.name} has insight selectors and it is logging."
                    findings.append(report)
        return findings

References