Hacktoberfest 2026: die Issues, die Maintainer für den Oktober markiert haben – offen und einsteigerfreundlich. Hacktoberfest-Issues durchsuchen

Turn on CloudTrail log file validation for the management-events trail

Offen Anfängerfreundlich
  • Stimmt etwas nicht?
#202 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
2/5
Geschätzter Aufwand
1-3 Stunden
Anfängerfreundlichkeit
75/100
Issue-Typ
Feature
Klarheit
Klar beschrieben
Aktivitätsstatus
Aktiv
Tech-Stack
aws, terraform
Bereich
infrastructure, security

Rechercherichtung

Die Arbeit findet in terraform/cloudtrail.tf statt. Suchen Sie die Ressource aws_cloudtrail.management_events und ändern Sie enable_log_file_validation auf true. Aktualisieren Sie den zweizeiligen Kommentar darüber und die Kommentarliste im Dateikopf. Führen Sie terraform plan aus, um zu bestätigen, dass nur diese Ressource vor Ort geändert wird. Nach dem Merge überprüfen Sie mit den bereitgestellten Befehlen aws cloudtrail describe-trails und aws s3 ls.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

complexity: small feature: security good first issue role: DevOps Engineer size: 0.5pt
Overview

We need to turn on CloudTrail log file validation for the management-events trail, so that both of the account's trails produce tamper-evident digest files. Today one trail has it on and the other has it off, which means the trail carrying the account's management events — the higher-value audit record of the two — is the one that cannot be proven unaltered.

Action Items
  • In terraform/cloudtrail.tf, change enable_log_file_validation from false to true on the aws_cloudtrail.management_events resource. It is on line 251 as of 2026-09-23 — line numbers drift, so find it by the resource name resource "aws_cloudtrail" "management_events" rather than by number.
  • Update the two-line comment immediately above that resource, which currently reads that the inconsistency is "reproduced rather than resolved -- turning it on is a live change and its own ticket." That ticket is this one, so the comment should now say the two trails agree and that validation is on for both. Leave the rest of the file's commentary alone.
  • Update the file-header comment near the top of terraform/cloudtrail.tf that lists four things deliberately not added by #191. Log file validation is one of the four; remove it from that list and leave the other three (KMS encryption, a CloudWatch Logs destination, a bucket lifecycle configuration) exactly as they are — each is still outstanding.
  • Confirm the plan shows exactly one resource changing, in place: aws_cloudtrail.management_events[0] with enable_log_file_validation: false -> true. There must be no replacement and nothing else in the diff. A replacement would destroy and recreate a trail carrying prevent_destroy, so it would fail at plan time — but check rather than rely on that.
  • Note this resource is gated on var.iam_only, so it is skipped entirely in a contributor's own AWS account and only applies in CI, where iam_only = false. A local plan with the default variable will show no change at all; that is expected and is not evidence the edit is wrong.
  • After the PR merges and the apply runs, confirm both trails report validation on: aws cloudtrail describe-trails --query 'trailList[].{Name:Name,Validation:LogFileValidationEnabled}' --output table. Both rows must read True.
  • After the PR merges, confirm digest files actually start being written, which is the real proof the setting took effect: aws s3 ls s3://aws-cloudtrail-logs-035866691871-6539ef03/AWSLogs/035866691871/CloudTrail-Digest/ --recursive | tail. Expect nothing for up to an hour — CloudTrail writes the first digest on its own schedule, not at apply time — so this step is deliberately separate from the one above and may need coming back to later in the day.
Resources/Instructions
  • terraform/cloudtrail.tf — the only file this ticket touches. The management_events trail is the second of the two declared in it; the first, tf_backend_logs, already has enable_log_file_validation = true and is the model.
  • devops-security#191 — imported both trails and both buckets as-is, and deliberately left this inconsistency in place. Its cloudtrail.tf comments name this as follow-on work.
  • Validating CloudTrail log file integrity — what the digest files are and how to verify one with aws cloudtrail validate-logs.
  • Digest files are delivered to the same bucket as the logs, under AWSLogs/<account>/CloudTrail-Digest/, and are billed as ordinary S3 objects. They are small and low-volume relative to the log files themselves, so this adds no meaningful storage cost.

Line numbers above were accurate on 2026-09-23 and may drift; locate the targets by resource name and by the quoted comment text instead.

Vorherrschende Sprache
TypeScript
Sterne
1
Forks
14
Ø Merge
4 Std. 7 Min.
Gemergte PRs (30 T.)
12

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus hackforla/devops-security

Alle Issues in hackforla/devops-security

Ähnliche Issues

Weitere Issues zu TypeScript

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.