aws.cloudtrail

Filters

config-compliance

event

event-selectors

finding

is-shadow

json-diff

list-item

marked-for-op

ops-item

reduce

status

value

event-selectors

Filter a cloudtrail by its related Event Selectors.

example:

policies:
  - name: cloudtrail-event-selectors
    resource: aws.cloudtrail
    filters:
    - type: event-selectors
      key: EventSelectors[].IncludeManagementEvents
      op: contains
      value: True

Permissions - cloudtrail:GetEventSelectors

is-shadow

Identify shadow trails (secondary copies), shadow trails can’t be modified directly, the origin trail needs to be modified.

Shadow trails are created for multi-region trails as well for organizational trails.

Permissions - cloudtrail:DescribeTrails

json-diff

Compute the diff from the current resource to a previous version.

A resource matches the filter if a diff exists between the current resource and the selected revision.

Utilizes config as a resource revision database.

Revisions can be selected by date, against the previous version, and against a locked version (requires use of is-locked filter).

Permissions - config:GetResourceConfigHistory

status

Filter a cloudtrail by its status.

Example:

policies:
  - name: cloudtrail-check-status
    resource: aws.cloudtrail
    filters:
    - type: status
      key: IsLogging
      value: False

Permissions - cloudtrail:GetTrailStatus

Actions

auto-tag-user

copy-related-tag

delete

invoke-lambda

invoke-sfn

mark-for-op

notify

post-finding

post-item

put-metric

remove-tag

rename-tag

set-logging

tag

update-trail

webhook

delete

Delete a cloud trail

example:

policies:
  - name: delete-cloudtrail
    resource: aws.cloudtrail
    filters:
     - type: value
       key: Name
       value: delete-me
       op: eq
    actions:
     - type: delete

Permissions - cloudtrail:DeleteTrail

rename-tag

Rename an existing tag key to a new value.

example:

rename Application, and Bap to App, if a resource has both of the old keys then we’ll use the value specified by Application, which is based on the order of values of old_keys.

policies:
- name: rename-tags-example
  resource: aws.log-group
  filters:
    - or:
      - "tag:Bap": present
      - "tag:Application": present
  actions:
    - type: rename-tag
      old_keys: [Application, Bap]
      new_key: App

Permissions - tag:TagResources, tag:UntagResources

set-logging

Set the logging state of a trail

Example:

policies:
  - name: cloudtrail-set-active
    resource: aws.cloudtrail
    filters:
     - type: status
       key: IsLogging
       value: False
    actions:
     - type: set-logging
       enabled: True

Permissions - cloudtrail:StartLogging

update-trail

Update trail attributes.

Example:

policies:
  - name: cloudtrail-set-log
    resource: aws.cloudtrail
    filters:
     - or:
       - KmsKeyId: empty
       - LogFileValidationEnabled: false
    actions:
     - type: update-trail
       attributes:
         KmsKeyId: arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef
         EnableLogFileValidation: true

Permissions - cloudtrail:UpdateTrail