Homepage
About Snyk

CloudTrail trail is associated with missing SNS topic Affecting CloudTrail service in AWS

0.0
medium
0
10
    Severity Framework Snyk CCSS
    Rule category Logging / Configuration

Is your enviroment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
    Frameworks
    CIS-Controls
  • Snyk ID SNYK-CC-00144
  • credit Snyk Research Team
Report a new misconfiguration Found a mistake?

Description

By associating a trail with an SNS topic, you can be notified when CloudTrail publishes new log files to your Amazon S3 bucket. The AWS API call history produced by CloudTrail enables security analysis, resource change tracking, and compliance auditing.

How to fix?

Ensure that if an aws_cloudtrail has an sns_topic_name set, the associated aws_sns_topic is not missing.

Example Configuration

resource "aws_cloudtrail" "valid_trail_by_topic_name" {
  name = "valid_trail_by_topic_name"
  s3_bucket_name = "${aws_s3_bucket.ct_bucket.id}"
  sns_topic_name = "${aws_sns_topic.ct_topic.name}"
}

resource "aws_sns_topic" "ct_topic" {
  name = "ct-topic"
  policy = <<EOF
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AWSCloudTrailSNSPolicy20131101",
            "Effect": "Allow",
            "Principal": {
                "Service": "cloudtrail.amazonaws.com"
            },
            "Action": "SNS:Publish",
            "Resource": "arn:aws:sns:us-east-2:123456789012:ct-topic"
        }
    ]
}
EOF
}