Back to Checks
aws

Customer managed IAM policy does not allow cloudtrail:* privileges

iam_policy_no_full_access_to_cloudtrail
Service: iamSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:AwsIamPolicy

Custom IAM policies are reviewed for statements that grant full CloudTrail access via the cloudtrail:* wildcard, indicating unrestricted permission to all CloudTrail actions.

Prowler logoProwlerprowler-provider-aws

Risk

Unrestricted CloudTrail control lets principals stop or alter logging, delete or modify trails, and query events.

This enables log evasion, audit tampering, and reconnaissance, undermining the integrity, availability, and confidentiality of audit evidence and detection.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks iam_policy_no_full_access_to_cloudtrail

Recommendation

Apply least privilege: avoid cloudtrail:* and allow only required actions.

Enforce separation of duties for trail management. Use permissions boundaries or SCPs to block broad CloudTrail access, and validate policies regularly to refine scopes.

Remediation

CLI

aws iam create-policy-version --policy-arn <example_policy_arn> --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"cloudtrail:DescribeTrails","Resource":"*"}]}' --set-as-default

Terraform

# IAM policy without CloudTrail wildcard access
resource "aws_iam_policy" "<example_resource_name>" {
  name   = "<example_resource_name>"
  policy = jsonencode({
    Version   = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = "cloudtrail:DescribeTrails" # Critical: replaces 'cloudtrail:*' with a specific action, removing full access
      Resource = "*"
    }]
  })
}

NativeIaC

# CloudFormation managed policy without CloudTrail wildcard access
Resources:
  <example_resource_name>:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action: cloudtrail:DescribeTrails  # Critical: replaces 'cloudtrail:*' with a specific action to remove full access
            Resource: "*"

Other

1In the AWS Console, go to IAM > Policies
2Open the custom managed policy that contains Action: "cloudtrail:*"
3Click Edit JSON
4Replace "cloudtrail:*" with only the specific CloudTrail actions needed (e.g., "cloudtrail:DescribeTrails" or "cloudtrail:LookupEvents"), or remove CloudTrail actions entirely
5Save changes to create/set the new default policy version
6Verify the policy no longer contains "cloudtrail:*"

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.iam.iam_client import iam_client
from prowler.providers.aws.services.iam.lib.policy import check_full_service_access

critical_service = "cloudtrail"


class iam_policy_no_full_access_to_cloudtrail(Check):
    def execute(self) -> Check_Report_AWS:
        findings = []
        for policy in iam_client.policies.values():
            # Check only custom policies
            if policy.type == "Custom":
                if not policy.attached and not iam_client.provider.scan_unused_services:
                    continue
                report = Check_Report_AWS(metadata=self.metadata(), resource=policy)
                report.region = iam_client.region
                report.status = "PASS"
                report.status_extended = f"Custom Policy {policy.name} does not allow '{critical_service}:*' privileges."

                if policy.document and check_full_service_access(
                    critical_service, policy.document
                ):
                    report.status = "FAIL"
                    report.status_extended = f"Custom Policy {policy.name} allows '{critical_service}:*' privileges."

                findings.append(report)
        return findings

References