CloudTrail logs are stored in S3 for audit.
Verify that a log file was not changed after it was delivered.
Which feature is most appropriate?
Enable CloudTrail log file integrity validation so digest files can be used to detect changes after delivery.
Detailed explanation
DNS health checks do not verify the integrity of audit log files.
DNS health checks do not verify the integrity of audit log files.
Integrity validation uses digest information to detect modification of delivered log files.
Integrity validation uses digest information to detect modification of delivered log files.
Public storage weakens the audit-log protection boundary.
Public storage weakens the audit-log protection boundary.
Deleting digests removes evidence needed for integrity verification.
Deleting digests removes evidence needed for integrity verification.
Check official documentation
Compare the following points with the official documentation.
AWS CloudTrail log file integrity validationの公式説明を確認する。
What to confirm
監査ログの保存と完全性検証をCloudTrailへ対応付けられる。
Key points
- CloudTrail log file validation
- Digest
- Tamper detection
Notes
- Environment: AWS公式CloudTrailドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Audit evidence
Integrity validation complements access controls by showing whether the stored audit evidence changed.
Retention of evidence
Deleting digest data removes the material needed to perform a later integrity check.