A single-account trail delivers audit logs for the target Region to S3. Verify whether logs delivered during the upcoming audit period have subsequently been changed or deleted. Log file validation is currently disabled.
The validator has AWS connectivity and required S3 read permissions. Retain logs and digests at their original delivery location. The trail ARN, Region, and audit-period UTC timestamps are known; record validation results.
Which configuration and validation procedure meets the objective?
Enable and retain digest delivery, then validate the target trail, Region, and UTC period at the original S3 delivery location.
Detailed explanation
Versioning retains object versions; it does not validate CloudTrail signatures, hashes, or digest chaining. Separate storage protection from actual integrity verification.
Versioning retains object versions; it does not validate CloudTrail signatures, hashes, or digest chaining. Separate storage protection from actual integrity verification.
Enabling digest delivery and checking signatures and hashes are separate. An enabled setting alone is not an actual validation result for the audit period.
Enabling digest delivery and checking signatures and hashes are separate. An enabled setting alone is not an actual validation result for the audit period.
The built-in CLI validates files at their original CloudTrail S3 delivery location, not local copies alone. Consider a custom implementation to validate files after they have been moved.
The built-in CLI validates files at their original CloudTrail S3 delivery location, not local copies alone. Consider a custom implementation to validate files after they have been moved.
Enabling the feature delivers validation digests; actual validation is a separate operation. Check signatures, log hashes, and chaining, recording results and periods that cannot be validated.
Enabling the feature delivers validation digests; actual validation is a separate operation. Check signatures, log hashes, and chaining, recording results and periods that cannot be validated.
Check official documentation
Compare the following points with the official documentation.
Review official steps for enabling the feature and digest delivery. For an approved test trail, check validate-logs --trail-arn, --region, --start-time, --end-time, and --verbose, recording signature, hash, chaining results, and the covered period.
Official references
- Official documentation 1
- Official documentation 2
- Official documentation 3
- Official documentation 4
- Official documentation 5
- Official documentation 6
What to confirm
Results cover the period digests and their referenced logs. Distinguish disabled, missing, and unverifiable periods; enabling the feature alone does not establish completed validation or collection of every event.
Key points
- Log file validation
- Digest file
- validate-logs
Notes
- Environment: Official CloudTrail and AWS CLI documentation and an approved test trail with original S3 logs and digests
- Reviewed against the linked AWS documentation on 2026-10-13.
Foundation review
Separate enabling delivery from performing validation
Enabling the feature starts digest delivery; configuration alone does not validate integrity. Digests reference log hashes; validate signatures and the chain to earlier digests. Storage and Versioning do not replace actual verification.
Check original location and the requested period
Specify the trail ARN, target Region, and UTC start and end times for AWS CLI validate-logs; use --verbose for detailed results. AWS connectivity and read access to original S3 logs and digests are required. Do not assume the built-in CLI validates only copies moved to local disk or another location.
Record scope and periods that cannot be validated
The CLI validates only logs referenced by digests. Logs delivered while validation was disabled do not receive digests retroactively. Missing or invalid digests can leave periods unverifiable. Check LatestDigestDeliveryError with get-trail-status for delivery issues. Integrity-validation success is not proof that every event was collected or the entire audit period covered.