Back to Checks
aws

CloudTrail trail has log file validation enabled

cloudtrail_log_file_validation_enabled
Service: cloudtrailSeverity: medium
OfficialBuilt-inVerified
Categories:loggingforensics-ready
Resource Type:AwsCloudTrailTrail

AWS CloudTrail trails are evaluated for log file integrity validation being enabled (LogFileValidationEnabled).

When enabled, CloudTrail generates signed digest files to verify that S3-delivered log files remain unchanged.

Prowler logoProwlerprowler-provider-aws

Risk

Without validation, adversaries can alter, forge, or delete audit entries without detection, compromising log integrity and non-repudiation.

This impairs investigations, enables alert evasion, and obscures unauthorized changes across regions or accounts.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks cloudtrail_log_file_validation_enabled

Recommendation

Enable log file integrity validation on all trails (LogFileValidationEnabled=true).

Enforce least privilege on the logs bucket, retain and protect digest files (e.g., S3 Object Lock/MFA Delete), and monitor validation results to support defense in depth.

Remediation

CLI

aws cloudtrail update-trail --name <trail_name> --enable-log-file-validation

Terraform

# Enable log file validation on a CloudTrail trail
resource "aws_cloudtrail" "<example_resource_name>" {
  name               = "<example_resource_name>"
  s3_bucket_name     = "<example_resource_name>"
  enable_log_file_validation = true  # Critical: ensures CloudTrail writes signed digests to detect tampering
}

NativeIaC

# CloudFormation: Enable log file validation on a CloudTrail trail
Resources:
  <example_resource_name>:
    Type: AWS::CloudTrail::Trail
    Properties:
      S3BucketName: <example_resource_name>
      EnableLogFileValidation: true  # Critical: enables integrity validation for delivered log files

Other

1Open the AWS Console and go to CloudTrail
2Click Trails and select <trail_name>
3Click Edit
4In Additional/Advanced settings, check Enable log file validation
5Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.cloudtrail.cloudtrail_client import (
    cloudtrail_client,
)


class cloudtrail_log_file_validation_enabled(Check):
    def execute(self):
        findings = []
        if cloudtrail_client.trails is not None:
            for trail in cloudtrail_client.trails.values():
                if trail.name:
                    report = Check_Report_AWS(metadata=self.metadata(), resource=trail)
                    report.region = trail.home_region
                    report.status = "FAIL"
                    if trail.is_multiregion:
                        report.status_extended = f"Multiregion trail {trail.name} has log file validation disabled."
                    else:
                        report.status_extended = f"Single region trail {trail.name} has log file validation disabled."
                    if trail.log_file_validation_enabled:
                        report.status = "PASS"
                        if trail.is_multiregion:
                            report.status_extended = f"Multiregion trail {trail.name} has log file validation enabled."
                        else:
                            report.status_extended = f"Single region trail {trail.name} has log file validation enabled."
                    findings.append(report)

        return findings

References