Skip to main content
emnode
Sign up
Compliance High severity

AWS Security Hub · CloudTrail

CloudTrail.1: No multi-Region trail captures read/write management events

Written and reviewed by Emnode · Last reviewed

What does AWS Security Hub CloudTrail.1 check?

CloudTrail.1 fails unless there is at least one multi-Region CloudTrail trail that records read and write management events for the account.

Why does CloudTrail.1 matter?

CloudTrail is your account's audit log: without a multi-Region trail, activity in Regions you do not actively use goes unrecorded, which is exactly where attackers operate to stay invisible. No trail means no forensics, no detective controls, and no way to answer "what happened?" after an incident.

How do I fix CloudTrail.1?

  1. Create a multi-Region trail (or convert an existing single-Region one) covering all Regions.
  2. Enable both read and write management events and deliver to an S3 bucket with Block Public Access and a restrictive policy.
  3. Manage trails centrally via an Organization trail so member accounts cannot turn logging off.

Remediation script · bash

# Create one multi-Region trail that satisfies the whole CloudTrail family.
aws cloudtrail create-trail \
  --name org-audit-trail \
  --s3-bucket-name my-cloudtrail-logs-bucket \
  --is-multi-region-trail \
  --include-global-service-events \
  --enable-log-file-validation \
  --cloud-watch-logs-log-group-arn arn:aws:logs:us-east-1:111122223333:log-group:/aws/cloudtrail/org:* \
  --cloud-watch-logs-role-arn arn:aws:iam::111122223333:role/CloudTrail_CloudWatchLogs_Role

# Capture read AND write management events (not data events, which are billed per event).
aws cloudtrail put-event-selectors --trail-name org-audit-trail \
  --event-selectors ReadWriteType=All,IncludeManagementEvents=true

# Defining the trail does not record anything: start it, then verify it is logging.
aws cloudtrail start-logging --name org-audit-trail
aws cloudtrail get-trail-status --name org-audit-trail --query IsLogging --output text

# For org-wide coverage, recreate with --is-organization-trail from the management
# or delegated-admin account so every member account inherits it automatically.

Full walkthrough (console steps, edge cases and verification) in the lesson Enable CloudTrail and API activity logging.

Is CloudTrail.1 a false positive?

Centralised logging through an organization trail is the recommended design, yet it changes how this account-level control reports in member accounts. The org trail is owned by the management (or delegated administrator) account, so its finding is generated there; in the member accounts it covers, Security Hub reports NO_DATA rather than a member-owned PASSED, because the member doesn't own a trail of its own. Reading that NO_DATA as a gap and creating a redundant per-account multi-Region trail just duplicates logging and cost without adding coverage. Confirm an organization trail capturing read and write management events is in place at the management account, then leave member accounts on the org trail and treat their NO_DATA as expected; the management-account finding is the one that proves coverage.

Full lesson Enable CloudTrail and API activity logging Step-by-step remediation with CLI, code and persona-specific context.
AWS documentation for CloudTrail controls ↗ Check your own account for CloudTrail.1 →
Part of the learning path See what's happening

More CloudTrail controls