| Plugin Title | CloudTrail Enabled |
| Cloud | AWS |
| Category | CloudTrail |
| Description | Ensures CloudTrail is enabled for all regions within an account |
| More Info | CloudTrail should be enabled for all regions in order to detect suspicious activity in regions that are not typically used. |
| AWS Link | http://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-getting-started.html |
| Recommended Action | Enable CloudTrail for all regions and ensure that at least one region monitors global service events |
- Log into the AWS Management Console.
- Select the "Services" option and search for "CloudTrail".
- In the "Dashboard" panel click on "View trails" button.
- Select the "trail" that needs to be verified under "Name" column.
- Click the pencil icon to go into "Trail Settings" and verify the checkbox marked against "Apply trail to all regions
". If "No" is selected than create and manage a trail across all regions is not possible.
- Go to "Trail Settings" and click on "Yes" checkbox to enable the "Apply trail to all regions" which receive the log files containing event history for the new region without taking any action. Click on the "Save" button to make the changes.
- Scroll down and go to "Additional Configuration" settings and click on the pencil icon to make the changes.
- Click on the "Yes" checkbox corresponding to the "Include global services" and click on "Save" button to make the changes.
- CloudTrail is enabled for all regions with global service events now.
