Back to Checks
huaweicloud

CTS tracker is enabled

cts_enabled
Service: ctsSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:NotDefined

Ensure that Cloud Trace Service (CTS) tracker is enabled to record all API calls and operations performed in the Huawei Cloud account.

Prowler logoProwlerprowler-provider-huaweicloud

Risk

Without CTS enabled, there is no audit trail of API calls and operations, making it difficult to detect, investigate, and respond to security incidents or unauthorized access.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler huaweicloud --checks cts_enabled

Recommendation

Enable the CTS system tracker to record all API calls and operations in the Huawei Cloud account.

Remediation

CLI

hcloud CTS CreateTracker --tracker_name="system" --tracker_type="system"

Other

1Log on to the **Huawei Cloud console**.
2Navigate to **Cloud Trace Service**.
3Click the **Trace Management** tab.
4Click **Enable CTS**.
5Configure the **OBS** bucket for trace file storage.
6Click **OK**.

Check Code

from prowler.lib.check.models import Check, CheckReportHuaweiCloud
from prowler.providers.huaweicloud.services.cts.cts_client import cts_client


class cts_enabled(Check):
    """Check if CTS tracker is enabled."""

    def execute(self) -> list[CheckReportHuaweiCloud]:
        findings = []

        if not cts_client.trackers:
            report = CheckReportHuaweiCloud(metadata=self.metadata(), resource={})
            report.region = cts_client.region
            report.resource_id = f"{cts_client.audited_account}-cts-tracker"
            report.resource_name = report.resource_id
            report.resource_arn = (
                f"HUAWEICLOUD::CTS::{cts_client.audited_account}:tracker"
            )
            report.status = "FAIL"
            report.status_extended = (
                "No CTS tracker found. Cloud Trace Service is not enabled."
            )
            findings.append(report)
        else:
            for tracker in cts_client.trackers:
                report = CheckReportHuaweiCloud(
                    metadata=self.metadata(), resource=tracker
                )
                report.region = tracker.region
                report.resource_id = tracker.id
                report.resource_arn = f"huaweicloud:cts:{tracker.region}:{cts_client.audited_account}:tracker/{tracker.id}"

                if tracker.is_enabled:
                    report.status = "PASS"
                    report.status_extended = (
                        f"CTS tracker {tracker.name} ({tracker.id}) is enabled."
                    )
                else:
                    report.status = "FAIL"
                    report.status_extended = (
                        f"CTS tracker {tracker.name} ({tracker.id}) is not enabled."
                    )

                findings.append(report)

        return findings

References