Posturio
Logging check • severity HIGH

CloudTrail Not Enabled

This page targets the check cloudtrail.not_enabled and the query "cloudtrail enabled check" so teams can move from search to remediation quickly. Instead of broad guidance, this page focuses on what the finding means in real operations, why it changes risk posture, and the fastest path to a verified fix.

Posturio is built for practical cloud security operations. You can run a scan, confirm whether this issue exists in your environment, and prioritize remediation with clear context and ownership. The goal is not a static checklist; it is a repeatable process that improves your posture over time.

Run Free AWS Scan See pricing

Check metadata

Check ID cloudtrail.not_enabled
Primary keyword cloudtrail enabled check
Category Logging
Severity HIGH
What it means

Understanding the finding in operational terms

CloudTrail is not enabled in required regions or accounts. In practice, this finding usually appears when baseline controls are implemented inconsistently across accounts, workloads, or teams. It can remain hidden for long periods because infrastructure drift happens gradually and ownership is often split between platform and application groups.

Treat this check as a control signal, not just a point-in-time warning. If the same issue appears after every deployment cycle, you likely need stronger preventive guardrails in infrastructure-as-code and review pipelines. Fast remediation is important, but durable prevention is what protects engineering velocity.

Why it matters

Risk impact and business implications

Security impact

Without CloudTrail you lack reliable API event history for incident response, investigations, and audits. Findings in this category often sit on critical attack paths, so delayed remediation can compound risk.

Operational impact

Unresolved controls increase incident response load and create repeated triage work for the same root cause. Teams lose time on reactive cleanup instead of planned hardening.

Trust impact

Customers, auditors, and procurement teams increasingly ask for concrete evidence around cloud controls. Fixing and verifying this issue improves both security outcomes and external trust conversations.

How to fix

Remediation steps for CloudTrail Not Enabled

  • Create an organization-level or account-level CloudTrail trail.
  • Enable management events in all required regions.
  • Deliver logs to protected S3 storage with restricted write access.
  • Configure alerting for high-risk API actions.

If your environment spans multiple AWS accounts, roll out this fix through shared IaC modules and policy validation checks. That reduces recurrence and keeps ownership clear across teams.

How to verify

Verification workflow for reliable closure

  • Confirm CloudTrail is active and collecting events.
  • Perform test API actions and validate logs appear.
  • Re-run Posturio and verify cloudtrail.not_enabled is resolved.

Verification should include both direct AWS configuration checks and scan-based confirmation. Combining these two methods catches false assumptions early and gives your team stronger evidence for internal or external reviews.

Example AWS posture score report generated by Posturio
Related checks
ALB Access Logs Disabled CloudFront Access Logs Disabled S3 Access Logs Disabled Application Load Balancer Is Public AMI Is Public API Gateway Missing WAF Protection All AWS security checks
FAQ

CloudTrail Not Enabled FAQs

Is one trail enough?

It can be, if it is multi-region and captures the event categories you need.

Do we need data events too?

For sensitive workloads yes, but scope them carefully to manage cost.

Can CloudTrail logs be tampered with?

Protect log destinations and enable validation controls to strengthen integrity.

How do I verify cloudtrail not enabled is fully remediated?

Re-run your scan and confirm cloudtrail.not_enabled passes, then review AWS configuration directly to validate persistence.

Last updated: 2026-03-09