{
  "Provider": "aws",
  "CheckID": "cloudtrail_multi_region_enabled_logging_management_events",
  "CheckTitle": "Ensure CloudTrail logging management events in All Regions",
  "CheckType": [
    "CIS AWS Foundations Benchmark"
  ],
  "ServiceName": "cloudtrail",
  "SubServiceName": "",
  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
  "Severity": "low",
  "ResourceType": "AwsCloudTrailTrail",
  "Description": "Ensure CloudTrail logging management events in All Regions",
  "Risk": "AWS CloudTrail enables governance, compliance, operational auditing, and risk auditing of your AWS account. To meet FTR requirements, you must have management events enabled for all AWS accounts and in all regions and aggregate these logs into an Amazon Simple Storage Service (Amazon S3) bucket owned by a separate AWS account.",
  "RelatedUrl": "https://docs.bridgecrew.io/docs/logging_14",
  "Remediation": {
    "Code": {
      "CLI": "aws cloudtrail update-trail --name <trail_name> --is-multi-region-trail",
      "NativeIaC": "",
      "Other": "https://docs.bridgecrew.io/docs/logging_14",
      "Terraform": "https://docs.bridgecrew.io/docs/logging_14#terraform"
    },
    "Recommendation": {
      "Text": "Enable CloudTrail logging management events in All Regions",
      "Url": "https://docs.bridgecrew.io/docs/logging_14"
    }
  },
  "Categories": [
    "forensics-ready"
  ],
  "DependsOn": [],
  "RelatedTo": [],
  "Notes": ""
}
