Accounts with no logging CloudTrail trail, or logging without multi-region coverage

Two gaps, three different findings

CloudTrail posture is not a single yes/no. The discoverer stamps two booleans per account: logging_enabled (some trail is actively recording) and multi_region_enabled (a multi-region trail exists). The rule ORs the gaps but words each combination honestly. No active trail is the worst case: nothing is being recorded anywhere. Logging confirmed on but single-region gets the narrower message: activity in every other region goes unaudited. And when only the multi-region flag is present and false, the finding says exactly that, without claiming logging is off. A finding that overstates its evidence teaches people to distrust the whole list.

When the rule stays silent

Both flags absent means the probe failed or the account is unknown, so the rule abstains rather than firing on a phantom zero. A present flag that reads true clears its own dimension, and an account with both true produces nothing. The rule therefore proves what it reports for the dimensions it has evidence on, and says nothing where it has none.

What an unlogged region costs you in practice

An attacker who gains credentials does not politely stay in your primary region. Spinning up miners in ap-southeast-1 or exfiltrating from a region you never use is standard playbook precisely because single-region trails were common for years. A multi-region trail closes that blind spot for management events at one stroke, and organization trails extend the same posture across every member account.

Inspect your own trails

aws cloudtrail describe-trails \
  --query 'trailList[].[Name,IsMultiRegionTrail,HomeRegion]' --output table
aws cloudtrail get-trail-status --name <trail-name> --query 'IsLogging'

Setting it up properly the first time

Create one multi-region trail, enable management read and write events, and store logs in an S3 bucket with versioning and encryption so the audit trail cannot be silently rewritten. CloudTrail’s first copy of management events is free; the S3 storage is the main recurring cost and is modest at management-event volume. Data events for S3 objects and Lambda are the expensive tier; enable them selectively where compliance actually requires them rather than account-wide by default.