AWS Logging & Detection Hardening

Run exactly one organization-wide AWS CloudTrail with all six hardening toggles simultaneously enabled: (1) multi-region so every region's API activity is captured even in regions the organisation does not consciously use; (2) organization-trail so every member account in the AWS Organization is recorded under a single trail definition the member cannot disable; (3) log-file-validation so each delivered log file carries an HMAC-signed digest CloudTrail can verify offline; (4) KMS-encrypted with a customer-managed CMK so log access requires both S3 read and KMS Decrypt; (5) S3 Object Lock in Compliance mode on the destination bucket with at least a one-year retention so an attacker (or a panicked engineer) cannot delete or overwrite log objects even with root credentials; (6) event selectors covering management events plus S3 data events plus Lambda data events so the trail records the data-plane calls that management events alone miss (AWS CloudTrail User Guide — creating a trail (accessed 2026-05)). Missing any of these six is the canonical CloudTrail misconfiguration; the IaC below shows them as a single coherent unit. This is the audit log of last resort — without it, incident response is reconstructing intent from secondary signals.

Remediation — AWS CLI

# Pre-step: create the KMS CMK for trail encryption (separate region per partition).
aws kms create-key \
  --description "CloudTrail org trail encryption CMK" \
  --key-usage ENCRYPT_DECRYPT

# Create the org trail with all six hardening toggles in one call.
aws cloudtrail create-trail \
  --name org-audit-trail \
  --s3-bucket-name org-cloudtrail-logs-111122223333 \
  --is-multi-region-trail \
  --is-organization-trail \
  --enable-log-file-validation \
  --kms-key-id arn:aws:kms:eu-west-1:111122223333:key/<cmk-id>

# Event selectors: management + S3 data + Lambda data events.
aws cloudtrail put-event-selectors \
  --trail-name org-audit-trail \
  --advanced-event-selectors '[
    {"Name":"Management events","FieldSelectors":[
      {"Field":"eventCategory","Equals":["Management"]}]},
    {"Name":"All S3 data events","FieldSelectors":[
      {"Field":"eventCategory","Equals":["Data"]},
      {"Field":"resources.type","Equals":["AWS::S3::Object"]}]},
    {"Name":"All Lambda data events","FieldSelectors":[
      {"Field":"eventCategory","Equals":["Data"]},
      {"Field":"resources.type","Equals":["AWS::Lambda::Function"]}]}
  ]'

# Start logging.
aws cloudtrail start-logging --name org-audit-trail

Remediation — Terraform

# Terraform AWS provider ~> 5.0
# Source: AWS docs (accessed 2026-05)
# Destination bucket: Object Lock Compliance mode, 365-day retention.
resource "aws_s3_bucket" "trail" {
  bucket              = "org-cloudtrail-logs-${var.payer_account_id}"
  object_lock_enabled = true
}

resource "aws_s3_bucket_object_lock_configuration" "trail" {
  bucket = aws_s3_bucket.trail.id
  rule {
    default_retention {
      mode = "COMPLIANCE"
      days = 365
    }
  }
}

resource "aws_s3_bucket_server_side_encryption_configuration" "trail" {
  bucket = aws_s3_bucket.trail.id
  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm     = "aws:kms"
      kms_master_key_id = aws_kms_key.trail.arn
    }
  }
}

resource "aws_kms_key" "trail" {
  description             = "CloudTrail org trail CMK"
  enable_key_rotation     = true
  deletion_window_in_days = 30
}

resource "aws_cloudtrail" "org" {
  name                          = "org-audit-trail"
  s3_bucket_name                = aws_s3_bucket.trail.id
  is_multi_region_trail         = true
  is_organization_trail         = true
  enable_log_file_validation    = true
  kms_key_id                    = aws_kms_key.trail.arn
  include_global_service_events = true

  advanced_event_selector {
    name = "Management events"
    field_selector {
      field  = "eventCategory"
      equals = ["Management"]
    }
  }
  advanced_event_selector {
    name = "All S3 data events"
    field_selector {
      field  = "eventCategory"
      equals = ["Data"]
    }
    field_selector {
      field  = "resources.type"
      equals = ["AWS::S3::Object"]
    }
  }
  advanced_event_selector {
    name = "All Lambda data events"
    field_selector {
      field  = "eventCategory"
      equals = ["Data"]
    }
    field_selector {
      field  = "resources.type"
      equals = ["AWS::Lambda::Function"]
    }
  }
}

Remediation — CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: Organization-wide CloudTrail multi-region trail with log-file validation and KMS-encrypted destination.
Parameters:
  TrailBucketName:
    Type: String
  TrailKmsKeyArn:
    Type: String
Resources:
  OrgTrail:
    Type: AWS::CloudTrail::Trail
    Properties:
      TrailName: org-management-events
      S3BucketName: !Ref TrailBucketName
      IsLogging: true
      IsMultiRegionTrail: true
      IsOrganizationTrail: true
      EnableLogFileValidation: true
      IncludeGlobalServiceEvents: true
      KMSKeyId: !Ref TrailKmsKeyArn

Remediation — AWS CDK (TypeScript)

import * as cdk from 'aws-cdk-lib';
import { aws_cloudtrail as ct, aws_s3 as s3, aws_kms as kms } from 'aws-cdk-lib';
import { Construct } from 'constructs';

export interface OrgTrailProps extends cdk.StackProps {
  trailBucketName: string;
  trailKmsKeyArn: string;
}

export class OrgTrailStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props: OrgTrailProps) {
    super(scope, id, props);

    const bucket = s3.Bucket.fromBucketName(this, 'TrailBucket', props.trailBucketName);
    const key = kms.Key.fromKeyArn(this, 'TrailKey', props.trailKmsKeyArn);

    new ct.Trail(this, 'OrgTrail', {
      trailName: 'org-management-events',
      bucket,
      encryptionKey: key,
      isMultiRegionTrail: true,
      isOrganizationTrail: true,
      enableFileValidation: true,
      includeGlobalServiceEvents: true,
    });
  }
}

Compliance mapping

fields @timestamp, eventName, requestParameters.name, requestParameters.isMultiRegionTrail, requestParameters.isOrganizationTrail, userIdentity.arn, sourceIPAddress, errorCode
          | filter eventSource = "cloudtrail.amazonaws.com" and eventName in ["StopLogging","UpdateTrail","DeleteTrail"]
          | filter requestParameters.name = "org-management-trail" or requestParameters.name like /-org-trail$/
          | sort @timestamp desc
          | limit 50

Equivalent on: Azure · GCP · OCI

Enable CloudTrail data events on every S3 bucket that holds sensitive content (PII, regulated data, audit logs themselves, secrets backups) and on every customer-facing or privilege-elevated Lambda function. Management events alone record bucket-level calls — CreateBucket, PutBucketPolicy, DeleteBucket — but they do not record GetObject or PutObject against bucket contents. Without data events, an attacker who lifts an IAM role with s3:GetObject on a sensitive bucket can exfiltrate every object without leaving any CloudTrail entry that names the objects accessed (AWS CloudTrail User Guide — logging data events (accessed 2026-05)). The same gap exists for Lambda: management events log CreateFunction and UpdateFunctionCode, but not the per-invocation record of which principal invoked the function with which payload. Note: data events are billed per event delivered, so blanket enablement across petabyte-scale data lakes can be cost-prohibitive — scope event selectors to the buckets where the audit-trail value justifies the cost (PII buckets, audit-log buckets, secrets-manager backup buckets, anywhere a single unauthorized read is a security incident).

Remediation — AWS CLI

# Add S3 data events on the PII bucket and Lambda data events on customer-facing fns.
aws cloudtrail put-event-selectors \
  --trail-name org-audit-trail \
  --advanced-event-selectors '[
    {"Name":"Management","FieldSelectors":[
      {"Field":"eventCategory","Equals":["Management"]}]},
    {"Name":"S3 sensitive bucket data events","FieldSelectors":[
      {"Field":"eventCategory","Equals":["Data"]},
      {"Field":"resources.type","Equals":["AWS::S3::Object"]},
      {"Field":"resources.ARN","StartsWith":[
        "arn:aws:s3:::pii-prod-eu-west-1/",
        "arn:aws:s3:::audit-archive-eu-west-1/"]}]},
    {"Name":"Lambda customer-facing data events","FieldSelectors":[
      {"Field":"eventCategory","Equals":["Data"]},
      {"Field":"resources.type","Equals":["AWS::Lambda::Function"]},
      {"Field":"resources.ARN","StartsWith":[
        "arn:aws:lambda:eu-west-1:111122223333:function:public-api-"]}]}
  ]'

Remediation — Terraform

# Terraform AWS provider ~> 5.0
# Source: AWS docs (accessed 2026-05)
# Scoped data events as a second trail (keeps the org trail's blanket selector
# unaffected while letting per-bucket selectors evolve independently).
resource "aws_cloudtrail" "sensitive_data_events" {
  name                          = "sensitive-data-events"
  s3_bucket_name                = aws_s3_bucket.trail.id
  is_multi_region_trail         = true
  enable_log_file_validation    = true
  kms_key_id                    = aws_kms_key.trail.arn

  event_selector {
    read_write_type           = "All"
    include_management_events = false

    data_resource {
      type = "AWS::S3::Object"
      values = [
        "arn:aws:s3:::pii-prod-eu-west-1/",
        "arn:aws:s3:::audit-archive-eu-west-1/",
      ]
    }
  }

  event_selector {
    read_write_type           = "All"
    include_management_events = false

    data_resource {
      type = "AWS::Lambda::Function"
      values = [
        "arn:aws:lambda:eu-west-1:111122223333:function:public-api-checkout",
        "arn:aws:lambda:eu-west-1:111122223333:function:public-api-auth",
      ]
    }
  }
}

Remediation — CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: CloudTrail trail capturing S3 object-level data events on sensitive buckets.
Parameters:
  TrailBucketName:
    Type: String
  SensitiveBucketArn:
    Type: String
Resources:
  S3DataEventsTrail:
    Type: AWS::CloudTrail::Trail
    Properties:
      TrailName: s3-data-events
      S3BucketName: !Ref TrailBucketName
      IsLogging: true
      IsMultiRegionTrail: true
      AdvancedEventSelectors:
        - Name: S3 object-level reads/writes
          FieldSelectors:
            - Field: eventCategory
              Equals: [Data]
            - Field: resources.type
              Equals: [AWS::S3::Object]
            - Field: resources.ARN
              StartsWith: [!Ref SensitiveBucketArn]

Compliance mapping

fields @timestamp, eventName, requestParameters.trailName, requestParameters.eventSelectors, requestParameters.advancedEventSelectors, userIdentity.arn
          | filter eventSource = "cloudtrail.amazonaws.com" and eventName = "PutEventSelectors"
          | filter requestParameters.trailName like /-org-trail$/ or requestParameters.trailName like /-data-events-trail$/
          | sort @timestamp desc
          | limit 50

Equivalent on: Azure · GCP · OCI

Enable AWS Config in every region of every account in the organization, with both a Configuration Recorder (capturing every supported resource type) and a Delivery Channel (shipping snapshots and configuration-history items to a central S3 bucket), and apply a Conformance Pack of detective rules that benchmark resource state against the organisation's policy (AWS Config Developer Guide — conformance packs (accessed 2026-05)). Config answers a question CloudTrail cannot: what does this resource look like right now, and how has it changed. CloudTrail records the API calls; Config records the resulting resource state and runs continuous evaluation against rules. The two are complementary — CloudTrail is the timeline of intent, Config is the timeline of result. The conformance-pack approach is the AWS-recommended pattern for declaring "these N rules must evaluate non-compliant resources to NON_COMPLIANT and create a finding"; it ships as a single YAML document so the policy set is version-controlled in the same repo as the rest of the landing-zone. Without Config the organisation has no resource-state inventory, no continuous-compliance signal, and no input for the resource-change correlations that GuardDuty (aws-log-04) and Security Hub (aws-log-05) consume.

Remediation — AWS CLI

# Enable the recorder (capture every supported resource type and global resources).
aws configservice put-configuration-recorder --configuration-recorder '{
  "name":"default",
  "roleARN":"arn:aws:iam::111122223333:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig",
  "recordingGroup":{
    "allSupported":true,
    "includeGlobalResourceTypes":true}}'

# Delivery channel: ship to the central S3 bucket.
aws configservice put-delivery-channel --delivery-channel '{
  "name":"default",
  "s3BucketName":"org-config-history-111122223333",
  "configSnapshotDeliveryProperties":{"deliveryFrequency":"One_Hour"}}'

# Start recording.
aws configservice start-configuration-recorder --configuration-recorder-name default

# Deploy a conformance pack across the organization.
aws configservice put-organization-conformance-pack \
  --organization-conformance-pack-name org-security-baseline \
  --template-s3-uri s3://org-config-packs/security-baseline.yaml

Remediation — Terraform

# Terraform AWS provider ~> 5.0
# Source: AWS docs (accessed 2026-05)
resource "aws_config_configuration_recorder" "this" {
  name     = "default"
  role_arn = aws_iam_role.config.arn

  recording_group {
    all_supported                 = true
    include_global_resource_types = true
  }
}

resource "aws_config_delivery_channel" "this" {
  name           = "default"
  s3_bucket_name = aws_s3_bucket.config.id
  snapshot_delivery_properties {
    delivery_frequency = "One_Hour"
  }
  depends_on = [aws_config_configuration_recorder.this]
}

resource "aws_config_configuration_recorder_status" "this" {
  name       = aws_config_configuration_recorder.this.name
  is_enabled = true
  depends_on = [aws_config_delivery_channel.this]
}

resource "aws_config_organization_conformance_pack" "baseline" {
  name              = "org-security-baseline"
  template_s3_uri   = "s3://org-config-packs/security-baseline.yaml"
  delivery_s3_bucket = aws_s3_bucket.config.id
}

Remediation — CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: AWS Config recorder and delivery channel for all-resource recording in the account.
Parameters:
  ConfigRoleArn:
    Type: String
  ConfigBucketName:
    Type: String
Resources:
  ConfigRecorder:
    Type: AWS::Config::ConfigurationRecorder
    Properties:
      Name: org-config-recorder
      RoleARN: !Ref ConfigRoleArn
      RecordingGroup:
        AllSupported: true
        IncludeGlobalResourceTypes: true
  ConfigDeliveryChannel:
    Type: AWS::Config::DeliveryChannel
    Properties:
      Name: org-config-channel
      S3BucketName: !Ref ConfigBucketName

Compliance mapping

fields @timestamp, eventName, requestParameters.configurationRecorderName, requestParameters.recordingGroup.allSupported, requestParameters.recordingGroup.resourceTypes, userIdentity.arn
          | filter eventSource = "config.amazonaws.com" and eventName in ["StopConfigurationRecorder","DeleteConfigurationRecorder","DeleteDeliveryChannel","PutConfigurationRecorder"]
          | sort @timestamp desc
          | limit 100

Equivalent on: Azure · GCP · OCI

Enable Amazon GuardDuty across the entire AWS Organization via a delegated administrator account, with every data source turned on as a single umbrella: CloudTrail management-event analysis (always-on), VPC Flow Logs and DNS query log analysis, S3 protection (S3 data-event analysis), EKS protection (EKS audit log analysis), Malware Protection (agentless EBS volume scanning), RDS Protection (login-event analysis on Aurora MySQL and Aurora PostgreSQL), and Lambda Protection (network activity analysis) (Amazon GuardDuty User Guide — what is GuardDuty (accessed 2026-05)). GuardDuty is managed threat detection — AWS runs and tunes the detection models, AWS curates the threat-intelligence feeds, and the organisation only pays for the data analysed. There is no on-prem analogue to switch off, no rule library to maintain, and no reason to operate the data sources as separately-enabled controls — they share a single detector resource, a single delegated-admin model, and a single org-configuration. Treat the data sources as facets of one umbrella control; do not split into five sub-controls (Open Question §8 resolution). GuardDuty surfaces findings under broad categories — Recon:*, UnauthorizedAccess:*, Backdoor:*, Trojan:*, Stealth:*, CryptoCurrency:*, Impact:*, PenTest:*, Policy:* — and the underlying full finding-type strings change as AWS adds detectors, so reference the category prefixes rather than enumerating the full finding-type list (Pitfall 9). GuardDuty findings flow into Security Hub by default and into EventBridge as native events.

Remediation — AWS CLI

# In the Organizations management account: delegate GuardDuty admin.
aws guardduty enable-organization-admin-account \
  --admin-account-id 222233334444

# In the delegated-admin account: enable the detector with all features.
DETECTOR_ID=$(aws guardduty create-detector \
  --enable \
  --finding-publishing-frequency FIFTEEN_MINUTES \
  --features \
    Name=S3_DATA_EVENTS,Status=ENABLED \
    Name=EKS_AUDIT_LOGS,Status=ENABLED \
    Name=EBS_MALWARE_PROTECTION,Status=ENABLED \
    Name=RDS_LOGIN_EVENTS,Status=ENABLED \
    Name=LAMBDA_NETWORK_LOGS,Status=ENABLED \
  --query DetectorId --output text)

# Auto-enrol every existing and future member account.
aws guardduty update-organization-configuration \
  --detector-id "$DETECTOR_ID" \
  --auto-enable-organization-members ALL \
  --features \
    Name=S3_DATA_EVENTS,AutoEnable=NEW \
    Name=EKS_AUDIT_LOGS,AutoEnable=NEW \
    Name=EBS_MALWARE_PROTECTION,AutoEnable=NEW \
    Name=RDS_LOGIN_EVENTS,AutoEnable=NEW \
    Name=LAMBDA_NETWORK_LOGS,AutoEnable=NEW

Remediation — Terraform

# Terraform AWS provider ~> 5.0
# Source: AWS docs (accessed 2026-05)
# In the Organizations management account.
resource "aws_guardduty_organization_admin_account" "this" {
  admin_account_id = var.security_account_id
}

# In the delegated-admin (security) account.
resource "aws_guardduty_detector" "this" {
  enable                       = true
  finding_publishing_frequency = "FIFTEEN_MINUTES"
}

resource "aws_guardduty_detector_feature" "s3" {
  detector_id = aws_guardduty_detector.this.id
  name        = "S3_DATA_EVENTS"
  status      = "ENABLED"
}

resource "aws_guardduty_detector_feature" "eks" {
  detector_id = aws_guardduty_detector.this.id
  name        = "EKS_AUDIT_LOGS"
  status      = "ENABLED"
}

resource "aws_guardduty_detector_feature" "ebs_malware" {
  detector_id = aws_guardduty_detector.this.id
  name        = "EBS_MALWARE_PROTECTION"
  status      = "ENABLED"
}

resource "aws_guardduty_detector_feature" "rds" {
  detector_id = aws_guardduty_detector.this.id
  name        = "RDS_LOGIN_EVENTS"
  status      = "ENABLED"
}

resource "aws_guardduty_detector_feature" "lambda" {
  detector_id = aws_guardduty_detector.this.id
  name        = "LAMBDA_NETWORK_LOGS"
  status      = "ENABLED"
}

resource "aws_guardduty_organization_configuration" "this" {
  detector_id                      = aws_guardduty_detector.this.id
  auto_enable_organization_members = "ALL"
}

Remediation — CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: GuardDuty detector with all current protection plans enabled (S3, EKS audit + runtime, malware, RDS, Lambda).
Resources:
  GuardDutyDetector:
    Type: AWS::GuardDuty::Detector
    Properties:
      Enable: true
      FindingPublishingFrequency: FIFTEEN_MINUTES
      Features:
        - Name: S3_DATA_EVENTS
          Status: ENABLED
        - Name: EKS_AUDIT_LOGS
          Status: ENABLED
        - Name: EBS_MALWARE_PROTECTION
          Status: ENABLED
        - Name: RDS_LOGIN_EVENTS
          Status: ENABLED
        - Name: LAMBDA_NETWORK_LOGS
          Status: ENABLED
        - Name: EKS_RUNTIME_MONITORING
          Status: ENABLED
          AdditionalConfiguration:
            - Name: EKS_ADDON_MANAGEMENT
              Status: ENABLED

Remediation — AWS CDK (TypeScript)

import * as cdk from 'aws-cdk-lib';
import { aws_guardduty as gd } from 'aws-cdk-lib';
import { Construct } from 'constructs';

export class GuardDutyDetectorStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    new gd.CfnDetector(this, 'Detector', {
      enable: true,
      findingPublishingFrequency: 'FIFTEEN_MINUTES',
      features: [
        { name: 'S3_DATA_EVENTS', status: 'ENABLED' },
        { name: 'EKS_AUDIT_LOGS', status: 'ENABLED' },
        { name: 'EBS_MALWARE_PROTECTION', status: 'ENABLED' },
        { name: 'RDS_LOGIN_EVENTS', status: 'ENABLED' },
        { name: 'LAMBDA_NETWORK_LOGS', status: 'ENABLED' },
        {
          name: 'EKS_RUNTIME_MONITORING',
          status: 'ENABLED',
          additionalConfiguration: [
            { name: 'EKS_ADDON_MANAGEMENT', status: 'ENABLED' },
          ],
        },
      ],
    });
  }
}

Compliance mapping

fields @timestamp, eventName, requestParameters.detectorId, requestParameters.enable, requestParameters.dataSources, requestParameters.accountIds, userIdentity.arn
          | filter eventSource = "guardduty.amazonaws.com" and eventName in ["DeleteDetector","UpdateDetector","DisassociateMembers","DeleteMembers"]
          | sort @timestamp desc
          | limit 100

Equivalent on: Azure · GCP · OCI

Enable AWS Security Hub across the entire Organization via a delegated administrator account, with at minimum the CIS AWS Foundations Benchmark v3.0.0, the AWS Foundational Security Best Practices (FSBP), and the PCI DSS standards subscribed (AWS Security Hub User Guide — what is Security Hub (accessed 2026-05)). Security Hub is the finding-aggregation layer that ingests outputs from GuardDuty, Amazon Inspector, Amazon Macie, IAM Access Analyzer, Firewall Manager, AWS Config rules, and Health, and normalises them into the AWS Security Finding Format (ASFF). The standards subscription is the operationally interesting half: once subscribed, Security Hub continuously evaluates every account in scope against the standard's controls and produces a compliance score plus a list of failing resources. CIS AWS Foundations v3.0.0 covers the IAM, logging, and monitoring fundamentals; FSBP covers AWS-recommended best practices outside the CIS scope (KMS rotation, RDS public-access, ELB logging); PCI DSS covers cardholder-data-environment controls when applicable. Security Hub findings drive the EventBridge automated-containment pipeline of aws-ir-02; treat Security Hub as the single pane of glass for the detective stack and the trigger source for response automation.

Remediation — AWS CLI

# In the Organizations management account: delegate Security Hub admin.
aws securityhub enable-organization-admin-account \
  --admin-account-id 222233334444

# In the delegated-admin account: enable Security Hub and subscribe standards.
aws securityhub enable-security-hub --enable-default-standards

# Subscribe to CIS AWS Foundations v3.0.0.
aws securityhub batch-enable-standards \
  --standards-subscription-requests StandardsArn=arn:aws:securityhub:eu-west-1::standards/cis-aws-foundations-benchmark/v/3.0.0

# Subscribe to PCI DSS v3.2.1.
aws securityhub batch-enable-standards \
  --standards-subscription-requests StandardsArn=arn:aws:securityhub:eu-west-1::standards/pci-dss/v/3.2.1

# Auto-enrol every member account.
aws securityhub update-organization-configuration --auto-enable

Remediation — Terraform

# Terraform AWS provider ~> 5.0
# Source: AWS docs (accessed 2026-05)
resource "aws_securityhub_organization_admin_account" "this" {
  admin_account_id = var.security_account_id
}

resource "aws_securityhub_account" "this" {
  enable_default_standards = true
}

resource "aws_securityhub_standards_subscription" "cis_v3" {
  standards_arn = "arn:aws:securityhub:${var.region}::standards/cis-aws-foundations-benchmark/v/3.0.0"
  depends_on    = [aws_securityhub_account.this]
}

resource "aws_securityhub_standards_subscription" "fsbp" {
  standards_arn = "arn:aws:securityhub:${var.region}::standards/aws-foundational-security-best-practices/v/1.0.0"
  depends_on    = [aws_securityhub_account.this]
}

resource "aws_securityhub_standards_subscription" "pci_dss" {
  standards_arn = "arn:aws:securityhub:${var.region}::standards/pci-dss/v/3.2.1"
  depends_on    = [aws_securityhub_account.this]
}

resource "aws_securityhub_organization_configuration" "this" {
  auto_enable = true
}

Remediation — CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: Security Hub enabled with the AWS Foundational Security Best Practices standard subscribed.
Resources:
  SecurityHub:
    Type: AWS::SecurityHub::Hub
    Properties:
      AutoEnableControls: true
      ControlFindingGenerator: SECURITY_CONTROL
      EnableDefaultStandards: true

Compliance mapping

fields @timestamp, eventName, requestParameters.standardsSubscriptionArns, requestParameters.autoEnable, userIdentity.arn, sourceIPAddress
          | filter eventSource = "securityhub.amazonaws.com" and eventName in ["BatchDisableStandards","UpdateOrganizationConfiguration","DisableSecurityHub","DisassociateFromAdministratorAccount"]
          | sort @timestamp desc
          | limit 100

Equivalent on: Azure · GCP · OCI

Enable VPC Flow Logs on every VPC in every account, capturing both ACCEPT and REJECT traffic, with the destination set to a central S3 bucket (KMS-encrypted) rather than CloudWatch Logs for any organisation operating at meaningful scale (Amazon VPC User Guide — Flow Logs (accessed 2026-05)). Flow logs record source/destination IP, source/destination port, protocol, packet count, byte count, start/end timestamps, action (ACCEPT/REJECT), and the AWS-side log status for every IP flow at the ENI level — the network-layer record that fills the gap CloudTrail (which only records API calls) leaves. The S3 destination is preferred at scale because CloudWatch Logs ingestion is roughly 10× more expensive per GB than S3 PUT for the same volume; the operational tradeoff is that S3 destinations need Athena or a SIEM connector for query, while CloudWatch destinations come with Logs Insights built-in. Pick S3 if the organisation already operates Athena or a SIEM that ingests S3; pick CloudWatch only for VPCs small enough that operational simplicity outweighs the bill. Capture both ACCEPT and REJECT — REJECT-only loses the lateral-movement signal where the attacker uses a permitted path; ACCEPT-only loses the perimeter-probing signal where the attacker rattles every closed port looking for an opening.

Remediation — AWS CLI

# Create a VPC Flow Log delivering ALL traffic to a central S3 bucket.
aws ec2 create-flow-logs \
  --resource-type VPC \
  --resource-ids vpc-0abc123def4567890 \
  --traffic-type ALL \
  --log-destination-type s3 \
  --log-destination arn:aws:s3:::org-vpc-flow-logs-111122223333/vpc-0abc123def4567890/

# Audit: ensure every VPC in every region has a flow log.
for region in $(aws ec2 describe-regions --query 'Regions[].RegionName' --output text); do
  for vpc in $(aws ec2 describe-vpcs --region "$region" --query 'Vpcs[].VpcId' --output text); do
    fl=$(aws ec2 describe-flow-logs --region "$region" \
      --filters Name=resource-id,Values="$vpc" \
      --query 'FlowLogs[].FlowLogId' --output text)
    if [ -z "$fl" ]; then echo "MISSING $region $vpc"; fi
  done
done

Remediation — Terraform

# Terraform AWS provider ~> 5.0
# Source: AWS docs (accessed 2026-05)
resource "aws_s3_bucket" "flow_logs" {
  bucket = "org-vpc-flow-logs-${var.payer_account_id}"
}

resource "aws_s3_bucket_server_side_encryption_configuration" "flow_logs" {
  bucket = aws_s3_bucket.flow_logs.id
  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm     = "aws:kms"
      kms_master_key_id = aws_kms_key.logs.arn
    }
  }
}

resource "aws_kms_key" "logs" {
  description         = "VPC flow log encryption CMK"
  enable_key_rotation = true
}

resource "aws_flow_log" "vpc" {
  for_each             = toset(var.vpc_ids)
  vpc_id               = each.value
  traffic_type         = "ALL"
  log_destination_type = "s3"
  log_destination      = "${aws_s3_bucket.flow_logs.arn}/${each.value}/"

  destination_options {
    file_format        = "parquet"
    per_hour_partition = true
  }
}

Remediation — CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: VPC flow logs streamed to a KMS-encrypted CloudWatch Logs group with explicit retention.
Parameters:
  VpcId:
    Type: AWS::EC2::VPC::Id
  FlowLogsRoleArn:
    Type: String
  FlowLogsKmsKeyArn:
    Type: String
Resources:
  FlowLogsGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub '/aws/vpc/flow-logs/${VpcId}'
      RetentionInDays: 365
      KmsKeyId: !Ref FlowLogsKmsKeyArn
  VpcFlowLog:
    Type: AWS::EC2::FlowLog
    Properties:
      ResourceId: !Ref VpcId
      ResourceType: VPC
      TrafficType: ALL
      LogDestinationType: cloud-watch-logs
      LogGroupName: !Ref FlowLogsGroup
      DeliverLogsPermissionArn: !Ref FlowLogsRoleArn

Compliance mapping

fields @timestamp, eventName, requestParameters.resourceIds, requestParameters.trafficType, requestParameters.logDestinationType, requestParameters.logDestination, userIdentity.arn
          | filter eventSource = "ec2.amazonaws.com" and eventName in ["DeleteFlowLogs","CreateFlowLogs","ModifyFlowLog"]
          | sort @timestamp desc
          | limit 100

Equivalent on: Azure · GCP · OCI

Define CloudWatch metric filters and alarms on the canonical "things-went-wrong" CloudTrail events: root account login, console login without MFA, IAM policy change, CloudTrail configuration change, KMS customer-managed key disable or scheduled deletion, S3 bucket policy change, NACL change, SG change, route-table change, unauthorized API call (errorCode AccessDenied or UnauthorizedOperation), AWS Config configuration changes, VPC change, network gateway change, STS GetSessionToken / GetFederationToken, and disabling of GuardDuty/Security Hub — the CIS AWS Foundations v3.0.0 §4.1–4.15 list, plus the modern additions (Amazon CloudWatch User Guide — events and metric filters (accessed 2026-05)). These are the events that should never happen during normal business operation; if they do, a human needs to look at them within minutes. Implementation pattern: a CloudWatch log group receives the CloudTrail trail (via the trail's CloudWatch Logs delivery option, or via a Lambda subscription from S3); a aws_cloudwatch_log_metric_filter matches the canonical event pattern; a aws_cloudwatch_metric_alarm triggers on any non-zero metric value over a 1-period evaluation window and routes via SNS to PagerDuty / Opsgenie / email. The CIS benchmark cells fill themselves out cleanly here because §4.1–4.15 specifies the exact event patterns.

Remediation — AWS CLI

# Metric filter: root account login (CIS §4.3 equivalent in the v3.0.0 numbering).
aws logs put-metric-filter \
  --log-group-name /aws/cloudtrail/org-audit-trail \
  --filter-name root-login \
  --filter-pattern '{$.userIdentity.type="Root" && $.userIdentity.invokedBy NOT EXISTS && $.eventType!="AwsServiceEvent"}' \
  --metric-transformations \
    metricName=RootAccountLogin,metricNamespace=SecurityAlarms,metricValue=1

# Alarm on any non-zero value of RootAccountLogin.
aws cloudwatch put-metric-alarm \
  --alarm-name root-account-login \
  --metric-name RootAccountLogin --namespace SecurityAlarms \
  --statistic Sum --period 300 --threshold 0 \
  --comparison-operator GreaterThanThreshold \
  --evaluation-periods 1 \
  --alarm-actions arn:aws:sns:eu-west-1:111122223333:security-pager

# Equivalent stubs for the rest of the §4.x set (IAM policy change, CT config change,
# KMS key disable, S3 bucket policy change, etc.) follow the same pattern — see
# the Terraform module below for the full list.

Remediation — Terraform

# Terraform AWS provider ~> 5.0
# Source: AWS docs (accessed 2026-05)
locals {
  cis_alarms = {
    root_login = {
      pattern = "{$.userIdentity.type=\"Root\" && $.userIdentity.invokedBy NOT EXISTS && $.eventType!=\"AwsServiceEvent\"}"
      metric  = "RootAccountLogin"
    }
    iam_policy_change = {
      pattern = "{($.eventName=DeleteGroupPolicy)||($.eventName=DeleteRolePolicy)||($.eventName=DeleteUserPolicy)||($.eventName=PutGroupPolicy)||($.eventName=PutRolePolicy)||($.eventName=PutUserPolicy)||($.eventName=CreatePolicy)||($.eventName=DeletePolicy)||($.eventName=CreatePolicyVersion)||($.eventName=DeletePolicyVersion)||($.eventName=AttachRolePolicy)||($.eventName=DetachRolePolicy)||($.eventName=AttachUserPolicy)||($.eventName=DetachUserPolicy)||($.eventName=AttachGroupPolicy)||($.eventName=DetachGroupPolicy)}"
      metric  = "IamPolicyChange"
    }
    cloudtrail_config_change = {
      pattern = "{($.eventName=CreateTrail)||($.eventName=UpdateTrail)||($.eventName=DeleteTrail)||($.eventName=StartLogging)||($.eventName=StopLogging)}"
      metric  = "CloudTrailConfigChange"
    }
    kms_key_disable = {
      pattern = "{($.eventSource=kms.amazonaws.com) && (($.eventName=DisableKey)||($.eventName=ScheduleKeyDeletion))}"
      metric  = "KmsKeyDisable"
    }
    s3_bucket_policy_change = {
      pattern = "{($.eventSource=s3.amazonaws.com) && (($.eventName=PutBucketAcl)||($.eventName=PutBucketPolicy)||($.eventName=PutBucketCors)||($.eventName=PutBucketLifecycle)||($.eventName=PutBucketReplication)||($.eventName=DeleteBucketPolicy)||($.eventName=DeleteBucketCors)||($.eventName=DeleteBucketLifecycle)||($.eventName=DeleteBucketReplication))}"
      metric  = "S3BucketPolicyChange"
    }
  }
}

resource "aws_cloudwatch_log_metric_filter" "cis" {
  for_each       = local.cis_alarms
  name           = each.key
  log_group_name = aws_cloudwatch_log_group.trail.name
  pattern        = each.value.pattern

  metric_transformation {
    name      = each.value.metric
    namespace = "SecurityAlarms"
    value     = "1"
  }
}

resource "aws_cloudwatch_metric_alarm" "cis" {
  for_each            = local.cis_alarms
  alarm_name          = "cis-${each.key}"
  metric_name         = each.value.metric
  namespace           = "SecurityAlarms"
  statistic           = "Sum"
  period              = 300
  threshold           = 0
  comparison_operator = "GreaterThanThreshold"
  evaluation_periods  = 1
  alarm_actions       = [aws_sns_topic.security_pager.arn]
  treat_missing_data  = "notBreaching"
}

Remediation — CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: CloudWatch alarm on root-account console-login event count (zero-tolerance).
Parameters:
  TrailLogGroupName:
    Type: String
  AlarmTopicArn:
    Type: String
Resources:
  RootLoginMetricFilter:
    Type: AWS::Logs::MetricFilter
    Properties:
      LogGroupName: !Ref TrailLogGroupName
      FilterPattern: '{ ($.userIdentity.type = "Root") && ($.eventName = "ConsoleLogin") }'
      MetricTransformations:
        - MetricName: RootConsoleLogins
          MetricNamespace: Security/Identity
          MetricValue: '1'
  RootLoginAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: root-console-login
      MetricName: RootConsoleLogins
      Namespace: Security/Identity
      Statistic: Sum
      Period: 60
      EvaluationPeriods: 1
      Threshold: 0
      ComparisonOperator: GreaterThanThreshold
      TreatMissingData: notBreaching
      AlarmActions:
        - !Ref AlarmTopicArn

Compliance mapping

fields @timestamp, eventName, requestParameters.alarmNames, requestParameters.filterName, requestParameters.logGroupName, userIdentity.arn
          | filter eventSource in ["monitoring.amazonaws.com","logs.amazonaws.com"] and eventName in ["DeleteAlarms","DisableAlarmActions","DeleteMetricFilter","PutMetricAlarm"]
          | filter requestParameters.alarmNames.0 like /^security-/ or requestParameters.filterName like /^security-/
          | sort @timestamp desc
          | limit 100

Equivalent on: Azure · GCP · OCI

Provision a CloudTrail Lake event data store with at least 7-year retention as the forensic SQL surface over CloudTrail history. CloudTrail Lake (GA 2023) is a managed, immutable, ACID-queryable store for CloudTrail events that lets incident responders run SQL — joins, aggregates, regex filters, time-range scans — against billions of API calls without standing up Athena, partitioning S3 logs, or maintaining a SIEM index of CloudTrail data (AWS CloudTrail User Guide — CloudTrail Lake (accessed 2026-05)). The pairing is critical: aws-ir-04 on the AWS IR page documents the forensic-query workflow (pre-built SQL for "which roles did this principal assume in the last 90 days", "which IPs called sensitive APIs against this account", and so on); this control ships the data store those queries run against. The control is typed RESPONSIVE because the value-add over the raw S3-backed CloudTrail logs is in the post-incident query workflow — Lake does not detect anything by itself, it accelerates the response phase. CIS AWS Foundations v3.0.0 (Jan 2024) post-dates CloudTrail Lake GA but does not codify it as a numbered control, hence the cell reads n/a (post-v3.0.0). Severity MEDIUM because the cheaper-but-slower fallback (Athena over the S3 trail logs) covers the same forensic surface for organisations whose IR cadence does not need sub-second query response.

Remediation — AWS CLI

# Create an organization-wide multi-region event data store with 7-year retention.
aws cloudtrail create-event-data-store \
  --name org-forensic-lake \
  --retention-period 2557 \
  --multi-region-enabled \
  --organization-enabled \
  --advanced-event-selectors '[
    {"Name":"Management events","FieldSelectors":[
      {"Field":"eventCategory","Equals":["Management"]}]}]'

# Run a forensic query.
EDS_ID=<event-data-store-id>
aws cloudtrail start-query --query-statement \
  "SELECT eventTime, eventName, sourceIPAddress
   FROM ${EDS_ID}
   WHERE userIdentity.accessKeyId = 'AKIA...'
   AND eventTime > '2026-01-01T00:00:00Z'
   ORDER BY eventTime"

Remediation — Terraform

# Terraform AWS provider ~> 5.0
# Source: AWS docs (accessed 2026-05)
resource "aws_cloudtrail_event_data_store" "forensic" {
  name                 = "org-forensic-lake"
  retention_period     = 2557   # ~7 years (max).
  multi_region_enabled = true
  organization_enabled = true

  advanced_event_selector {
    name = "Management events"
    field_selector {
      field  = "eventCategory"
      equals = ["Management"]
    }
  }

  # Termination protection on by default — flip to false only to delete.
  termination_protection_enabled = true
}

Remediation — CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: CloudTrail Lake event data store for long-horizon (7-year) management-event analytics.
Resources:
  AnalyticsEventDataStore:
    Type: AWS::CloudTrail::EventDataStore
    Properties:
      Name: cloudtrail-lake-analytics
      MultiRegionEnabled: true
      OrganizationEnabled: true
      RetentionPeriod: 2557
      TerminationProtectionEnabled: true
      AdvancedEventSelectors:
        - Name: Management events
          FieldSelectors:
            - Field: eventCategory
              Equals: [Management]

Compliance mapping

fields @timestamp, eventName, requestParameters.eventDataStore, requestParameters.retentionPeriod, requestParameters.queryStatement, userIdentity.arn
          | filter eventSource = "cloudtrail.amazonaws.com" and eventName in ["DeleteEventDataStore","UpdateEventDataStore","StartQuery"]
          | sort @timestamp desc
          | limit 100

Equivalent on: Azure · GCP · OCI · pairs with aws-ir-04 forensic queries