security-policies/bundle/compliance/cis_aws/rules/cis_4_10/data.yaml [11:41]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  audit: |-
    Perform the following to ensure that there is at least one active multi-region CloudTrail with prescribed metric filters and alarms configured:

    1. Identify the log group name configured for use with active multi-region CloudTrail:

    - List all CloudTrails: `aws cloudtrail describe-trails`

    - Identify Multi region Cloudtrails: `Trails with "IsMultiRegionTrail" set to true`

    - From value associated with CloudWatchLogsLogGroupArn note `<cloudtrail_log_group_name>`

    Example: for CloudWatchLogsLogGroupArn that looks like `arn:aws:logs:<region>:<aws_account_number>:log-group:NewGroup:*`, `<cloudtrail_log_group_name>` would be `NewGroup`

    - Ensure Identified Multi region CloudTrail is active

    `aws cloudtrail get-trail-status --name <Name of a Multi-region CloudTrail>`

    ensure `IsLogging` is set to `TRUE`

    - Ensure identified Multi-region Cloudtrail captures all Management Events

    `aws cloudtrail get-event-selectors --trail-name <trailname shown in describe-trails>`

    Ensure there is at least one Event Selector for a Trail with `IncludeManagementEvents` set to `true` and `ReadWriteType` set to `All`

    2. Get a list of all associated metric filters for this `<cloudtrail_log_group_name>`:
    ```
    aws logs describe-metric-filters --log-group-name "<cloudtrail_log_group_name>"
    ```
    3. Ensure the output from the above command contains the following:
    ```
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



security-policies/bundle/compliance/cis_aws/rules/cis_4_11/data.yaml [12:42]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  audit: |-
    Perform the following to ensure that there is at least one active multi-region CloudTrail with prescribed metric filters and alarms configured:

    1. Identify the log group name configured for use with active multi-region CloudTrail:

    - List all CloudTrails: `aws cloudtrail describe-trails`

    - Identify Multi region Cloudtrails: `Trails with "IsMultiRegionTrail" set to true`

    - From value associated with CloudWatchLogsLogGroupArn note `<cloudtrail_log_group_name>`

    Example: for CloudWatchLogsLogGroupArn that looks like `arn:aws:logs:<region>:<aws_account_number>:log-group:NewGroup:*`, `<cloudtrail_log_group_name>` would be `NewGroup`

    - Ensure Identified Multi region CloudTrail is active

    `aws cloudtrail get-trail-status --name <Name of a Multi-region CloudTrail>`

    ensure `IsLogging` is set to `TRUE`

    - Ensure identified Multi-region Cloudtrail captures all Management Events

    `aws cloudtrail get-event-selectors --trail-name <trailname shown in describe-trails>`

    Ensure there is at least one Event Selector for a Trail with `IncludeManagementEvents` set to `true` and `ReadWriteType` set to `All`

    2. Get a list of all associated metric filters for this `<cloudtrail_log_group_name>`:
    ```
    aws logs describe-metric-filters --log-group-name "<cloudtrail_log_group_name>"
    ```
    3. Ensure the output from the above command contains the following:
    ```
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



