Description

Detects AWS CloudTrail trails configured without log file validation in CloudFormation templates. Disabling or omitting log file validation makes it impossible to verify if CloudTrail logs have been tampered with, which weakens security audit capabilities and compliance.

Detection Strategy

• Review CloudFormation templates for AWS::CloudTrail::Trail resource definitions

• Check if the EnableLogFileValidation property is either missing or set to false

• Flag CloudTrail resources that do not explicitly enable log file validation

Vulnerable code example

Resources:
  myTrail:
    Type: AWS::CloudTrail::Trail
    Properties:
      IsLogging: true
      S3BucketName: audit-bucket
      EnableLogFileValidation: false  # Vulnerable: Log file validation disabled, logs can be tampered
  ...

✅ Secure code example

Resources:
  myTrail:
    Type: AWS::CloudTrail::Trail
    Properties:
      IsLogging: true
      S3BucketName: audit-bucket
      EnableLogFileValidation: true  # Enabled log validation to prevent tampering
  ...