AWS CloudTrail trail should have global service events enabled

문서 > Datadog 보안 > OOTB Rules > AWS CloudTrail trail should have global service events enabled

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Description

Ensure that an AWS CloudTrail trail has global service events enabled.

Rationale

Easily troubleshoot security issues for global services that aren’t region-specific.

Remediation

From the console

By default, trail logs created in the CloudTrail console log global service events. For more information, see the About global service events docs.

From the command line

Run aws cloudtrail describe-trails

Run update-trail on any returned trail name above to include-global-service-events.

aws cloudtrail update-trail \
    --name <INSERT-TRAIL-NAME> \
    --include-global-service-events

NOTE: The trail must be located in us-east-1 region to include global service events. Enabling global service events automatically updates the trail to be multi-regional.