How to Fix CloudTrail.1: Enable a Multi-Region CloudTrail Trail with Read and Write Management Events

CloudTrail.1 is an AWS Security Hub CSPM control (CIS AWS Foundations 3.1) that fails when an account has no logging multi-Region CloudTrail trail capturing both read and write management events. To fix it, create a multi-Region trail with log file validation, run start-logging, and remove any KMS or RDS Data API exclusions from its event selectors.

In practice it fails for one of three reasons: the only trail covers a single Region, logging was stopped, or someone trimmed the event selectors to save money.

What the scanner is actually detecting

The finding comes from AWS Security Hub, which current AWS documentation calls Security Hub CSPM. Reports show it with this exact title:

[CloudTrail.1] CloudTrail should be enabled and configured with at least one multi-Region trail that includes read and write management events

This is a configuration check read through the AWS API, not a CVE or a host plugin. It is one of the baseline checks any cloud security posture management (CSPM) tool runs against an AWS account.

The control fails when any of these is true:

• No trail in the account is a multi-Region trail.
• A multi-Region trail exists but logging is stopped.
• The trail records only Read or only Write management events, or no management events.
• Management events are excluded. The Config rule is NON_COMPLIANT when ExcludeManagementEventSources is not empty, or when the trail excludes events such as AWS KMS or Amazon RDS Data API events.

Because the resource is the account, the finding names an account ID rather than a trail ARN. CloudTrail.2 (KMS encryption), CloudTrail.4 (log file validation) and CloudTrail.5 (CloudWatch Logs) often fail alongside it.

Real-world risk, stated honestly

A missing trail is not exploitable on its own. It is a detection and forensics gap. CloudTrail records who called which API, when, from which source IP and with which parameters. Without a trail, that record is not retained in S3 and cannot feed your SIEM.

A single-Region trail has two blind spots. First, activity in Regions you do not normally use goes unrecorded; AWS notes that a multi-Region trail helps detect unexpected activity in otherwise unused Regions. Second, since November 22, 2021, CloudTrail records IAM, AWS STS and CloudFront events in US East (N. Virginia) only, so a single-Region trail anywhere else misses role assumptions and policy changes.

The High severity reflects the effect on every later incident: when something goes wrong, you may have no evidence of how it happened.

How to confirm it in the account

Run these with credentials for the account named in the finding. Commands use bash quoting. describe-trails includes shadow trails by default, so it also lists multi-Region and organization trails whose home Region is elsewhere.

aws cloudtrail describe-trails 
  --query 'trailList[].{Name:Name,Home:HomeRegion,MultiRegion:IsMultiRegionTrail,Org:IsOrganizationTrail,Validation:LogFileValidationEnabled,Arn:TrailARN}' 
  --output table

For each multi-Region trail, check status and event selectors in its home Region. Use the full ARN; from a member account, an organization trail can only be queried by ARN.

aws cloudtrail get-trail-status --region us-east-1 
  --name arn:aws:cloudtrail:us-east-1:111122223333:trail/management-events

aws cloudtrail get-event-selectors --region us-east-1 
  --trail-name arn:aws:cloudtrail:us-east-1:111122223333:trail/management-events

• IsLogging must be true. A value in LatestDeliveryError means CloudTrail cannot write to the bucket, usually because of the bucket policy.
• Basic selectors must show “ReadWriteType”: “All”, “IncludeManagementEvents”: true and an empty ExcludeManagementEventSources.
• Advanced selectors should look like the AWS default: one field, eventCategory equals Management. A readOnly field, or an eventSource NotEquals kms.amazonaws.com or rdsdata.amazonaws.com, fails the check.

To see the control’s current status in Security Hub:

aws securityhub get-findings 
  --filters '{"ComplianceSecurityControlId":[{"Value":"CloudTrail.1","Comparison":"EQUALS"}],"RecordState":[{"Value":"ACTIVE","Comparison":"EQUALS"}]}' 
  --query 'Findings[].{Account:AwsAccountId,Region:Region,Status:Compliance.Status}' 
  --output table

How to fix it

Console, single account

In the CloudTrail console, open Trails and choose Create trail. Console trails are multi-Region by default and start logging automatically. Security Hub’s remediation asks for:

• Additional settings, Log file validation: Enabled.
• Choose log events, Management events, API activity: Read and Write, with the exclusion check boxes cleared.

For an existing trail, open it, choose Edit under Management events, select Read and Write, and clear Exclude AWS KMS events and Exclude Amazon RDS Data API events.

AWS CLI: create-trail with –is-multi-region-trail

If CloudTrail did not create the bucket, attach a bucket policy first. AWS recommends a dedicated bucket. This is AWS’s single-account example with placeholder values:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AWSCloudTrailAclCheck20150319",
      "Effect": "Allow",
      "Principal": {"Service": "cloudtrail.amazonaws.com"},
      "Action": "s3:GetBucketAcl",
      "Resource": "arn:aws:s3:::amzn-s3-demo-bucket",
      "Condition": {"StringEquals": {
        "aws:SourceArn": "arn:aws:cloudtrail:us-east-1:111122223333:trail/management-events"}}
    },
    {
      "Sid": "AWSCloudTrailWrite20150319",
      "Effect": "Allow",
      "Principal": {"Service": "cloudtrail.amazonaws.com"},
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::amzn-s3-demo-bucket/AWSLogs/111122223333/*",
      "Condition": {"StringEquals": {
        "s3:x-amz-acl": "bucket-owner-full-control",
        "aws:SourceArn": "arn:aws:cloudtrail:us-east-1:111122223333:trail/management-events"}}
    }
  ]
}

aws s3api put-bucket-policy --bucket amzn-s3-demo-bucket 
  --policy file://cloudtrail-bucket-policy.json

aws cloudtrail create-trail --region us-east-1 --name management-events 
  --s3-bucket-name amzn-s3-demo-bucket 
  --is-multi-region-trail --enable-log-file-validation

# CLI-created trails do not log until you start them
aws cloudtrail start-logging --region us-east-1 --name management-events

A new trail logs all management events by default. To repair an existing trail’s selectors, set them explicitly:

aws cloudtrail put-event-selectors --region us-east-1 --trail-name management-events 
  --event-selectors '[{"ReadWriteType": "All","ExcludeManagementEventSources": [],"IncludeManagementEvents": true}]'

A trail uses either basic or advanced selectors, not both. If it logs data events through advanced selectors, keep them and use this form, adding the data event selectors to the same array:

aws cloudtrail put-event-selectors --region us-east-1 --trail-name management-events 
  --advanced-event-selectors '[{"Name": "Log all management events","FieldSelectors": [{"Field": "eventCategory","Equals": ["Management"]}]}]'

Converting a single-Region trail

Trails can only be updated from their home Region:

aws cloudtrail update-trail --region us-east-2 --name my-trail 
  --is-multi-region-trail --enable-log-file-validation

Check the bucket policy first. It must name the service principal cloudtrail.amazonaws.com; older policies that list per-Region CloudTrail account IDs only allow delivery from those Regions.

AWS Organizations: organization trail

A CloudTrail organization trail logs the management account and every member account, and accounts that join later are added automatically. The organization needs all features enabled and CloudTrail trusted access. Run this from the management account or a CloudTrail delegated administrator:

aws organizations enable-aws-service-access --service-principal cloudtrail.amazonaws.com

aws cloudtrail create-trail --region us-east-1 --name org-management-events 
  --s3-bucket-name amzn-s3-demo-bucket 
  --is-organization-trail --is-multi-region-trail --enable-log-file-validation

aws cloudtrail start-logging --region us-east-1 --name org-management-events

The bucket policy needs a third statement: s3:PutObject on arn:aws:s3:::amzn-s3-demo-bucket/AWSLogs/o-exampleorgid/* with the same two conditions, where aws:SourceArn is the trail ARN in the management account. Two planning points:

• Member accounts can see the organization trail but cannot stop, delete or change it.
• Do not pick an opt-in Region as the home Region. Member accounts that have not enabled that Region send nothing to the trail.

How to verify the fix and rescan

aws cloudtrail describe-trails 
  --query 'trailList[?IsMultiRegionTrail==`true`].[Name,HomeRegion,IsOrganizationTrail]' --output table

aws cloudtrail get-trail-status --region us-east-1 --name management-events 
  --query '{Logging:IsLogging,LastDelivery:LatestDeliveryTime,Error:LatestDeliveryError}'

Logs should appear under AWSLogs/<account-id>/CloudTrail/<region>/, or under AWSLogs/<org-id>/<account-id>/ for an organization trail. Once digest files arrive, test log file validation (add –account-id for an organization trail):

aws cloudtrail validate-logs --region us-east-1 
  --trail-arn arn:aws:cloudtrail:us-east-1:111122223333:trail/management-events 
  --start-time 2026-09-26T00:00:00Z

CloudTrail.1 is periodic: Security Hub reruns it within 12 or 24 hours of the last run, and you cannot change that schedule. When the compliance status turns PASSED, Security Hub sets the workflow status to RESOLVED. Rerun the get-findings query for every account and Region.

What can break and how to roll back

• Cost: AWS warns that high-volume KMS events can substantially raise your bill when more than one trail captures management events. When you add an organization trail, retire redundant per-account trails.
• Bucket policy mistakes: if the bucket is unreachable, CloudTrail retries delivery for 30 days and charges for those attempts. Fix the policy or delete the trail.
• Security Lake: if CloudTrail management events are enabled in Amazon Security Lake, you cannot delete or narrow the only multi-Region organization trail logging read and write events.

Rollback, run from the trail’s home Region:

aws cloudtrail stop-logging --region us-east-1 --name management-events
aws cloudtrail update-trail --region us-east-2 --name my-trail --no-is-multi-region-trail
aws cloudtrail delete-trail --region us-east-1 --name management-events

Deleting a trail keeps its bucket, log files and CloudWatch log group. Deleting a multi-Region trail stops logging in every Region, and any of these commands brings the finding back.

Common false positive reasons

True false positives are rare because the check reads trail configuration directly. Findings that look wrong usually trace back to one of these:

• Stale result: the periodic evaluation has not run since your change.
• Deliberate cost exclusions: a trail excluding KMS or RDS Data API events, or set to WriteOnly, fails by design. If you accept that risk, suppress the finding with a documented exception.
• Organization trail not reaching the account: logging is stopped, or the home Region is an opt-in Region the member account has not enabled.
• Wrong account or Region: check the account in the finding, against the trail’s home Region.

FAQ

Isn’t CloudTrail on by default?

Event history is. It shows 90 days of management events for the account you are signed in to, but it is not a trail and does not satisfy CloudTrail.1.

Does CloudTrail log file validation affect CloudTrail.1?

No. Validation is checked by CloudTrail.4, a Low severity control. The CloudTrail.1 remediation still recommends enabling it.

Can I exclude KMS events and still pass?

No. A non-empty ExcludeManagementEventSources is non-compliant. Keep one multi-Region trail with no exclusions and avoid duplicating management events across trails.

With an organization trail, do member accounts need their own trail?

Not for this control. The organization trail records management events for every member account, including accounts that join later.

Tracking this finding across many accounts

On a multi-account estate, the work is proving every account and Region stays covered, not fixing one trail. SITEY, a self-hosted vulnerability management platform, imports findings from 16 scanners and uses AI triage that suggests false positives with evidence while a human decides, so first confirm your cloud posture source is among the supported scanners. Duplicates are merged per scanner, not across scanners. For where posture checks sit next to workload protection, see CSPM vs CWPP vs CNAPP.

Sources

• AWS: Security Hub CSPM controls for AWS CloudTrail
• AWS Config: multi-region-cloudtrail-enabled rule
• AWS CloudTrail: Using the update-trail command
• AWS CloudTrail: Logging management events
• AWS CloudTrail: Creating a trail for an organization