CloudTrail trail does not log all management events (Read + Write)

Severity: High
Service: CloudTrail
Check ID: CLOUDTRAIL_NOT_LOGGING_MANAGEMENT_EVENTS

What this check finds

This CloudTrail trail has custom event selectors configured but does not log both Read and Write management events. CIS requires all management events to be captured for complete audit coverage.

Passing looks like: CloudTrail logs all management events.

How to fix it

Update the trail event selectors to include all management events.

AWS CLI

aws cloudtrail put-event-selectors --trail-name TRAIL_NAME --event-selectors "[{\"ReadWriteType\":\"All\",\"IncludeManagementEvents\":true,\"DataResources\":[]}]"

Names in capitals are placeholders for your own resource. Review a command before you run it.

AWS console

CloudTrail → Trails → Edit → Management events → Read + Write.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to CloudTrail trail does not log all management events (Read + Write)
Framework	Controls
CIS AWS Foundations Benchmark v5.0.0	3.1 Ensure CloudTrail is enabled in all regions
NIST SP 800-53 Rev5 (Moderate)	AU-2 Event Logging AU-3 Content of Audit Records AU-12 Audit Record Generation
NIST Cybersecurity Framework 2.0	PR.PS-04 Log records are generated for monitoring
ISO/IEC 27001:2022 Annex A	A.8.15 Logging

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More CloudTrail checks

All CloudTrail checks