diff --git a/avd_docs/aws/cloudtrail/AVD-AWS-0182/docs.md b/avd_docs/aws/cloudtrail/AVD-AWS-0182/docs.md new file mode 100644 index 000000000..c364854c3 --- /dev/null +++ b/avd_docs/aws/cloudtrail/AVD-AWS-0182/docs.md @@ -0,0 +1,13 @@ + +Ensures CloudTrail logs are being properly delivered to CloudWatch + +### Impact + + + +{{ remediationActions }} + +### Links +- https://docs.aws.amazon.com/awscloudtrail/latest/userguide/send-cloudtrail-events-to-cloudwatch-logs.html#send-cloudtrail-events-to-cloudwatch-logs-console + + diff --git a/internal/rules/policies/cloud/policies/aws/cloudtrail/ensure_cloudwatch_integration.rego b/internal/rules/policies/cloud/policies/aws/cloudtrail/ensure_cloudwatch_integration.rego new file mode 100644 index 000000000..f4d63ae2e --- /dev/null +++ b/internal/rules/policies/cloud/policies/aws/cloudtrail/ensure_cloudwatch_integration.rego @@ -0,0 +1,25 @@ +# METADATA +# title: "CloudTrail To CloudWatch" +# description: "Ensures CloudTrail logs are being properly delivered to CloudWatch" +# scope: package +# schemas: +# - input: schema.input +# related_resources: +# - https://docs.aws.amazon.com/awscloudtrail/latest/userguide/send-cloudtrail-events-to-cloudwatch-logs.html#send-cloudtrail-events-to-cloudwatch-logs-console +# custom: +# avd_id: AVD-AWS-0182 +# provider: aws +# service: cloudtrail +# severity: LOW +# short_code: ensure-cloudwatch-integration +# recommended_action: "Enable CloudTrail CloudWatch integration for all regions" +# input: +# selector: +# - type: cloud +package builtin.aws.cloudtrail.aws0182 + +deny[res] { + trail := input.aws.cloudtrail.trails[_] + trail.cloudwatchlogsloggrouparn.value == "" + res := result.new("Trail does not have CloudWatch logging configured", trail.cloudwatchlogsloggrouparn) +} diff --git a/internal/rules/policies/cloud/policies/aws/cloudtrail/ensure_cloudwatch_integration_test.rego b/internal/rules/policies/cloud/policies/aws/cloudtrail/ensure_cloudwatch_integration_test.rego new file mode 100644 index 000000000..50a191496 --- /dev/null +++ b/internal/rules/policies/cloud/policies/aws/cloudtrail/ensure_cloudwatch_integration_test.rego @@ -0,0 +1,11 @@ +package builtin.aws.cloudtrail.aws0182 + +test_detects_when_not_configured { + r := deny with input as {"aws": {"cloudtrail": {"trails": [{"cloudwatchlogsloggrouparn": {"value": ""}}]}}} + count(r) == 1 +} + +test_when_configured { + r := deny with input as {"aws": {"cloudtrail": {"trails": [{"cloudwatchlogsloggrouparn": {"value": "arn:aws:logs:us-east-1:123456789012:log-group:my-log-group"}}]}}} + count(r) == 0 +}