Insufficient data authenticity validation - Cloudtrail Logs
Description
One or more Cloudtrail instances do not enable the EnableLogFileValidation attribute avoiding the integrity validation to be performed. This practice could aid an attacker to inject malicious information in log files without rainsing any alert.
Impact
Alterate the system logs integrity witouth raising alerts.
Recommendation
Set the EnableLogFileValidation attribute in true for all Cloudtrail instances.
Threat
Authenticated attacker from the Internet.
Expected Remediation Time
⌚ 15 minutes.
Score
Default score using CVSS 3.1. It may change depending on the context of the vulnerability.
Base
- Attack vector: N
- Attack complexity: H
- Privileges required: L
- User interaction: N
- Scope: U
- Confidentiality: N
- Integrity: L
- Availability: N
Temporal
- Exploit code madurity: P
- Remediation level: O
- Report confidence: C
Result
- Vector string: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C
- Score:
- Base: 3.1
- Temporal: 2.8
- Severity:
- Base: Low
- Temporal: Low
Code Examples
Compliant code
The resource correctly enables log file validation
Resources:
trail1:
Type: AWS::CloudTrail::Trail
Properties:
IsLogging: true
S3BucketName: bk1
EnableLogFileValidation: true
resource "aws_cloudtrail" "foobar" {
enable_log_file_validation = true
name = "tf-trail-foobar"
s3_bucket_name = aws_s3_bucket.foo.id
s3_key_prefix = "prefix"
include_global_service_events = false
}
Non compliant code
The resource does not enable log file validation
Resources:
trail1:
Type: AWS::CloudTrail::Trail
Properties:
IsLogging: true
S3BucketName: bk2
EnableLogFileValidation: false
resource "aws_cloudtrail" "foobar" {
enable_log_file_validation = false
name = "tf-trail-foobar"
s3_bucket_name = aws_s3_bucket.foo.id
s3_key_prefix = "prefix"
include_global_service_events = false
}
Using the AWS CLI, the following command checks CloudTrail trails have file integrity validation feature enabled
$ aws cloudtrail describe-trails
The command returns the following output
{
"trailList": [
{
"IncludeGlobalServiceEvents": true,
"Name": "MyGlobalTrail",
"TrailARN": "arn:aws:cloudtrail:us-east-1:
123456789012:trail/MyGlobalTrail",
"LogFileValidationEnabled": false,
"IsMultiRegionTrail": false,
"S3BucketName": "cloudtrail-global-logging",
"HomeRegion": "us-east-1"
}
]
}
If LogFileValidationEnabled config parameter value is set to false, the trail has an insecure configuration
Requirements
Search for vulnerabilities in your apps for free with our automated security testing! Start your 21-day free trial and discover the benefits of our Continuous Hacking Machine Plan. If you prefer a full service that includes the expertise of our ethical hackers, don't hesitate to contact us for our Continuous Hacking Squad Plan.