Hacktoberfest 2026 : les issues que les mainteneurs ont marquées pour octobre, ouvertes et accessibles aux débutants. Parcourir les issues Hacktoberfest

Turn on CloudTrail log file validation for the management-events trail

Ouverte Adaptée aux débutants
  • Quelque chose ne va pas ?
#202 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

Personne n'a encore pris cette issue.

Évaluation

Difficulté
2/5
Temps estimé
1-3 heures
Accessibilité débutants
75/100
Type d'issue
Fonctionnalité
Clarté
Clairement spécifiée
Activité
Active
Stack technique
aws, terraform
Domaine
infrastructure, security

Piste de recherche

Le travail se trouve dans terraform/cloudtrail.tf. Trouvez la ressource aws_cloudtrail.management_events et changez enable_log_file_validation en true. Mettez à jour le commentaire de deux lignes au-dessus et la liste de commentaires de l'en-tête du fichier. Exécutez terraform plan pour confirmer que seule cette ressource change sur place. Après la fusion, vérifiez avec les commandes fournies aws cloudtrail describe-trails et aws s3 ls.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

complexity: small feature: security good first issue role: DevOps Engineer size: 0.5pt
Overview

We need to turn on CloudTrail log file validation for the management-events trail, so that both of the account's trails produce tamper-evident digest files. Today one trail has it on and the other has it off, which means the trail carrying the account's management events — the higher-value audit record of the two — is the one that cannot be proven unaltered.

Action Items
  • In terraform/cloudtrail.tf, change enable_log_file_validation from false to true on the aws_cloudtrail.management_events resource. It is on line 251 as of 2026-09-23 — line numbers drift, so find it by the resource name resource "aws_cloudtrail" "management_events" rather than by number.
  • Update the two-line comment immediately above that resource, which currently reads that the inconsistency is "reproduced rather than resolved -- turning it on is a live change and its own ticket." That ticket is this one, so the comment should now say the two trails agree and that validation is on for both. Leave the rest of the file's commentary alone.
  • Update the file-header comment near the top of terraform/cloudtrail.tf that lists four things deliberately not added by #191. Log file validation is one of the four; remove it from that list and leave the other three (KMS encryption, a CloudWatch Logs destination, a bucket lifecycle configuration) exactly as they are — each is still outstanding.
  • Confirm the plan shows exactly one resource changing, in place: aws_cloudtrail.management_events[0] with enable_log_file_validation: false -> true. There must be no replacement and nothing else in the diff. A replacement would destroy and recreate a trail carrying prevent_destroy, so it would fail at plan time — but check rather than rely on that.
  • Note this resource is gated on var.iam_only, so it is skipped entirely in a contributor's own AWS account and only applies in CI, where iam_only = false. A local plan with the default variable will show no change at all; that is expected and is not evidence the edit is wrong.
  • After the PR merges and the apply runs, confirm both trails report validation on: aws cloudtrail describe-trails --query 'trailList[].{Name:Name,Validation:LogFileValidationEnabled}' --output table. Both rows must read True.
  • After the PR merges, confirm digest files actually start being written, which is the real proof the setting took effect: aws s3 ls s3://aws-cloudtrail-logs-035866691871-6539ef03/AWSLogs/035866691871/CloudTrail-Digest/ --recursive | tail. Expect nothing for up to an hour — CloudTrail writes the first digest on its own schedule, not at apply time — so this step is deliberately separate from the one above and may need coming back to later in the day.
Resources/Instructions
  • terraform/cloudtrail.tf — the only file this ticket touches. The management_events trail is the second of the two declared in it; the first, tf_backend_logs, already has enable_log_file_validation = true and is the model.
  • devops-security#191 — imported both trails and both buckets as-is, and deliberately left this inconsistency in place. Its cloudtrail.tf comments name this as follow-on work.
  • Validating CloudTrail log file integrity — what the digest files are and how to verify one with aws cloudtrail validate-logs.
  • Digest files are delivered to the same bucket as the logs, under AWSLogs/<account>/CloudTrail-Digest/, and are billed as ordinary S3 objects. They are small and low-volume relative to the log files themselves, so this adds no meaningful storage cost.

Line numbers above were accurate on 2026-09-23 and may drift; locate the targets by resource name and by the quoted comment text instead.

Langage dominant
HCL
Étoiles
1
Forks
14
Merge moyen
1 h 12 min
PR mergées (30 j)
20

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de hackforla/devops-security

Toutes les issues de hackforla/devops-security

Issues similaires

Plus d'issues DevOps

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.