Homepage

CloudTrail trail is associated with missing SNS topic Affecting CloudTrail service in AWS

Severity

0.0
medium
0
10
Severity Framework
Snyk CCSS
Rule category
Logging/ Configuration

Is your environment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
Frameworks
CIS-Controls
  • Snyk IDSNYK-CC-00144
  • creditSnyk Research Team
Report a new misconfiguration Found a mistake?

Description

By associating a trail with an SNS topic, you can be notified when CloudTrail publishes new log files to your Amazon S3 bucket. The AWS API call history produced by CloudTrail enables security analysis, resource change tracking, and compliance auditing.

How to fix?

Ensure that if an aws_cloudtrail has an sns_topic_name set, the associated aws_sns_topic is not missing.

Example Configuration

resource "aws_cloudtrail" "valid_trail_by_topic_name" {
  name = "valid_trail_by_topic_name"
  s3_bucket_name = "${aws_s3_bucket.ct_bucket.id}"
  sns_topic_name = "${aws_sns_topic.ct_topic.name}"
}

resource "aws_sns_topic" "ct_topic" {
  name = "ct-topic"
  policy = <<EOF
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AWSCloudTrailSNSPolicy20131101",
            "Effect": "Allow",
            "Principal": {
                "Service": "cloudtrail.amazonaws.com"
            },
            "Action": "SNS:Publish",
            "Resource": "arn:aws:sns:us-east-2:123456789012:ct-topic"
        }
    ]
}
EOF
}