CloudTrail log file integrity validation is disabled

Description

Enabling CloudTrail log file integrity validation produces signed digests that can help identify log changes or deletion. It neither prevents tampering nor automatically runs validation.

Potential impact

Without the digests, verifying that archived audit logs remain intact can be harder.

Remediation

Set enable_log_file_validation: true and retain both logs and digests. Use CloudTrail log validation tools when integrity checks are needed.

Examples

The examples enable log file integrity validation. Prepare the bucket, IAM role, and KMS key separately.

Before

yaml

- name: Create CloudTrail
  community.aws.cloudtrail:
    state: present
    name: default
    s3_bucket_name: mylogbucket
    region: us-east-1
    is_multi_region_trail: true
    cloudwatch_logs_role_arn: "arn:aws:iam::123456789012:role/CloudTrail_CloudWatchLogs_Role"
    cloudwatch_logs_log_group_arn: "arn:aws:logs:us-east-1:123456789012:log-group:CloudTrail/DefaultLogGroup:*"
    kms_key_id: "alias/MyAliasName"

- name: Create CloudTrail v2
  community.aws.cloudtrail:
    state: present
    name: default
    s3_bucket_name: mylogbucket
    region: us-east-1
    is_multi_region_trail: true
    enable_log_file_validation: false
    cloudwatch_logs_role_arn: "arn:aws:iam::123456789012:role/CloudTrail_CloudWatchLogs_Role"
    cloudwatch_logs_log_group_arn: "arn:aws:logs:us-east-1:123456789012:log-group:CloudTrail/DefaultLogGroup:*"
    kms_key_id: "alias/MyAliasName"

After