HackBlue

Tools · Cloud security · 10 / 24

How to set up AWS CloudTrail correctly: organization trail, validation, and protection

Create a multi-region organization trail to a dedicated logging account, enable log file validation, protect the bucket, and decide which data events to add.

10 min read · practice only with authorization

What you get without a trail

Every account has CloudTrail event history: 90 days of management events, viewable and searchable but not exported or retained. That is not enough for investigations that start weeks later. A trail delivers events continuously to an S3 bucket you control.

Management events, such as creating users or changing security groups, are the core. Data events, such as S3 object reads or Lambda invocations, are high volume and billed separately, so enable them selectively.

A good design

In AWS Organizations, create one organization trail in the management or delegated administrator account. It covers every account and region. Deliver to a bucket in a dedicated log archive account, with Object Lock or a bucket policy that denies deletion, so a compromised workload account cannot erase its own history. Enable log file validation to produce signed digest files, and encrypt with a KMS key.

Optionally send to CloudWatch Logs or CloudTrail Lake for querying.

Snippet
aws cloudtrail create-trail --name org-trail --s3-bucket-name hb-org-cloudtrail-logs \
  --is-multi-region-trail --is-organization-trail --enable-log-file-validation --kms-key-id alias/cloudtrail
aws cloudtrail start-logging --name org-trail
aws cloudtrail get-trail-status --name org-trail --query '{logging:IsLogging,lastDelivery:LatestDeliveryTime}'

Lab: verify integrity

In a sandbox, create a trail with validation enabled, make a few API calls, wait for delivery, then run validate-logs over the period. It checks every log file against the signed digests. Download one log file, change a byte, upload it back in a test bucket copy, and run validation against that copy to see it fail.

Log validation lets you show an investigator or auditor that logs were not altered after delivery.

Snippet
aws cloudtrail validate-logs --trail-arn arn:aws:cloudtrail:us-east-1:111122223333:trail/org-trail \
  --start-time 2026-11-02T00:00:00Z --verbose | tail -5

Watch the trail itself

Alert on StopLogging, DeleteTrail, UpdateTrail, and PutEventSelectors. Attackers who gain admin access often try to stop logging first. An SCP denying those actions for everyone except a break-glass role makes the trail tamper-resistant.

Add data events for sensitive buckets and for Lambda functions that handle secrets, and use advanced event selectors to keep costs predictable.

Diagram

A tamper-resistant CloudTrail

  1. Org trail

    Multi-region, all accounts.

  2. Log archive

    Dedicated account, deletion denied, KMS encrypted.

  3. Validation

    Signed digests; validate-logs proves integrity.

  4. Guard

    SCP denies StopLogging and DeleteTrail; alerts on attempts.

Check yourself

1. How long does CloudTrail event history keep management events without a trail?

2. Why deliver logs to a separate log archive account?

3. Which API call should always raise an alert?