CloudTrail trail is not multi-region

Severity: Low
Service: CloudTrail
Check ID: CLOUDTRAIL_NOT_MULTIREGION

What this check finds

When CloudTrail was first released, you had to specify which regions to enable it in. It now defaults to recording audit logs for all regions. It should be configured for multiregion.

Passing looks like: CloudTrail is multi-region.

How to fix it

Update the existing trail to be multi-region.

AWS CLI

aws cloudtrail update-trail --name TRAIL_NAME --is-multi-region-trail

Names in capitals are placeholders for your own resource. Review a command before you run it.

AWS console

CloudTrail → Trails → select trail → Edit → Multi-region trail → Yes.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to CloudTrail trail is not multi-region
Framework	Controls
CIS AWS Foundations Benchmark v5.0.0	3.1 Ensure CloudTrail is enabled in all regions
PCI-DSS v4.0.1	10.2 Audit logs are implemented to support the detection of anomalies and suspicious activity
HIPAA Security Rule	164.312(b) Implement hardware, software, and procedural mechanisms to record activity
SOC 2 — Trust Services Criteria	CC7.2 Security Event Monitoring
NIST SP 800-53 Rev5 (Moderate)	AU-2 Event Logging
NIST Cybersecurity Framework 2.0	PR.PS-04 Log records are generated for monitoring
ISO/IEC 27001:2022 Annex A	A.8.15 Logging

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More CloudTrail checks

All CloudTrail checks