Turn on CloudTrail log file validation for the management-events trail

工作在 terraform/cloudtrail.tf 中。找到 aws_cloudtrail.management_events 资源，将 enable_log_file_validation 改为 true。更新其上方的两行注释和文件头部的注释列表。运行 terraform plan 以确认仅该资源原地更改。合并后，使用提供的 aws cloudtrail describe-trails 和 aws s3 ls 命令进行验证。

Overview

We need to turn on CloudTrail log file validation for the management-events trail, so that both of the account's trails produce tamper-evident digest files. Today one trail has it on and the other has it off, which means the trail carrying the account's management events — the higher-value audit record of the two — is the one that cannot be proven unaltered.

Action Items

• In terraform/cloudtrail.tf, change enable_log_file_validation from false to true on the aws_cloudtrail.management_events resource. It is on line 251 as of 2026-09-23 — line numbers drift, so find it by the resource name resource "aws_cloudtrail" "management_events" rather than by number.
• Update the two-line comment immediately above that resource, which currently reads that the inconsistency is "reproduced rather than resolved -- turning it on is a live change and its own ticket." That ticket is this one, so the comment should now say the two trails agree and that validation is on for both. Leave the rest of the file's commentary alone.
• Update the file-header comment near the top of terraform/cloudtrail.tf that lists four things deliberately not added by #191. Log file validation is one of the four; remove it from that list and leave the other three (KMS encryption, a CloudWatch Logs destination, a bucket lifecycle configuration) exactly as they are — each is still outstanding.
• Confirm the plan shows exactly one resource changing, in place: aws_cloudtrail.management_events[0] with enable_log_file_validation: false -> true. There must be no replacement and nothing else in the diff. A replacement would destroy and recreate a trail carrying prevent_destroy, so it would fail at plan time — but check rather than rely on that.
• Note this resource is gated on var.iam_only, so it is skipped entirely in a contributor's own AWS account and only applies in CI, where iam_only = false. A local plan with the default variable will show no change at all; that is expected and is not evidence the edit is wrong.
• After the PR merges and the apply runs, confirm both trails report validation on: aws cloudtrail describe-trails --query 'trailList[].{Name:Name,Validation:LogFileValidationEnabled}' --output table. Both rows must read True.
• After the PR merges, confirm digest files actually start being written, which is the real proof the setting took effect: aws s3 ls s3://aws-cloudtrail-logs-035866691871-6539ef03/AWSLogs/035866691871/CloudTrail-Digest/ --recursive | tail. Expect nothing for up to an hour — CloudTrail writes the first digest on its own schedule, not at apply time — so this step is deliberately separate from the one above and may need coming back to later in the day.

Resources/Instructions

• terraform/cloudtrail.tf — the only file this ticket touches. The management_events trail is the second of the two declared in it; the first, tf_backend_logs, already has enable_log_file_validation = true and is the model.
• devops-security#191 — imported both trails and both buckets as-is, and deliberately left this inconsistency in place. Its cloudtrail.tf comments name this as follow-on work.
• Validating CloudTrail log file integrity — what the digest files are and how to verify one with aws cloudtrail validate-logs.
• Digest files are delivered to the same bucket as the logs, under AWSLogs/<account>/CloudTrail-Digest/, and are billed as ordinary S3 objects. They are small and low-volume relative to the log files themselves, so this adds no meaningful storage cost.

Line numbers above were accurate on 2026-09-23 and may drift; locate the targets by resource name and by the quoted comment text instead.